<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>211796</bug_id>
          
          <creation_ts>2020-05-12 12:58:49 -0700</creation_ts>
          <short_desc>Constant-fold common case of OpIsConstructor by speculating m_structure</short_desc>
          <delta_ts>2020-05-12 14:11:46 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>NEW</bug_status>
          <resolution></resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=144093</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Enhancement</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexey Shvayka">ashvayka</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>keith_miller</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1651874</commentid>
    <comment_count>0</comment_count>
    <who name="Alexey Shvayka">ashvayka</who>
    <bug_when>2020-05-12 12:58:49 -0700</bug_when>
    <thetext>For many function “types” we could know if it’s constructible from the structure cell.
For example, JSStrictFunction is always constructible, while JSArrowFunction and JSGeneratorFunction are not.
Probably we would just store a TriState on the structure and if every structure flowing into the IsConstructor is either TriState::True or TriState::False we can fold to a constant.
It’s possible we could store this info on the method table too.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>