diff options
Diffstat (limited to 'Source/JavaScriptCore/dfg/DFGAbstractState.cpp')
| -rw-r--r-- | Source/JavaScriptCore/dfg/DFGAbstractState.cpp | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp index 50b9e2b9f..18b5ad02a 100644 --- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp +++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp @@ -1262,11 +1262,17 @@ bool AbstractState::execute(unsigned indexInBlock) forNode(nodeIndex).set(SpecFunction); break; - case GetScopeChain: + case GetScope: node.setCanExit(false); forNode(nodeIndex).set(SpecCellOther); break; - + + case GetScopeRegisters: + node.setCanExit(false); + forNode(node.child1()).filter(SpecCell); + forNode(nodeIndex).clear(); // The result is not a JS value. + break; + case GetScopedVar: node.setCanExit(false); forNode(nodeIndex).makeTop(); @@ -1477,7 +1483,7 @@ bool AbstractState::execute(unsigned indexInBlock) // Again, sadly, we don't propagate the fact that we've done InstanceOf if (!(m_graph[node.child1()].prediction() & ~SpecCell) && !(forNode(node.child1()).m_type & ~SpecCell)) forNode(node.child1()).filter(SpecCell); - forNode(node.child3()).filter(SpecCell); + forNode(node.child2()).filter(SpecCell); forNode(nodeIndex).set(SpecBoolean); break; |