haikuwebkit/LayoutTests/js/dfg-put-by-val-direct-to-ge...

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/dfg-put-by-val-direct-to-generic-array.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
DFG can call PutByValDirect for generic arrays https://bugs.webkit.org/show_bug.cgi?id=140389 Reviewed by Geoffrey Garen. Source/JavaScriptCore: Computed properties in object initializers (ES6) use the put_by_val_direct operation. However, current DFG asserts that put_by_val_direct is not used for the generic array, the assertion failure is raised. This patch allow DFG to use put_by_val_direct to generic arrays. And fix the DFG put_by_val_direct implementation for string properties. At first, put_by_val_direct is inteded to be used for spread elements. So the property keys were limited to numbers (indexes). But now, it's also used for computed properties in object initializers. * dfg/DFGOperations.cpp: (JSC::DFG::operationPutByValInternal): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): LayoutTests: * js/dfg-put-by-val-direct-to-generic-array-expected.txt: Added. * js/dfg-put-by-val-direct-to-generic-array.html: Added. * js/script-tests/dfg-put-by-val-direct-to-generic-array.js: Added. (foo1): (foo2): Canonical link: https://commits.webkit.org/158378@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@178370 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-01-13 20:17:54 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/dfg-put-by-val-direct-to-generic-array.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`