CFA wrongly assumes that a speculation for SlowPutArrayStorageShape disallows ArrayStorageShape arrays.
<https://webkit.org/b/139327>
Reviewed by Michael Saboff.
Source/JavaScriptCore:
The code generator and runtime slow paths expects otherwise. This patch fixes
CFA to match the code generator's expectation.
* dfg/DFGArrayMode.h:
(JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
(JSC::DFG::ArrayMode::arrayModesWithIndexingShapes):
LayoutTests:
* js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt: Added.
* js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html: Added.
* js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js: Added.
(foo):
(test):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@176972 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html b/LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html
new file mode 100644
index 0000000..e7489aa
--- /dev/null
+++ b/LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js"></script>
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
