Bug 158802 – DFGByteCodeParser should be able to infer the value of unset properties in MultiGetByOffset

• Component: New Bugs
• Status: RESOLVED FIXED

[Keith Miller]

DFGByteCodeParser should be able to infer the value of unset properties in MultiGetByOffset

[Keith Miller]

Created attachment 281376 [details]
Patch

[Geoffrey Garen]

Comment on attachment 281376 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=281376&action=review

> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:2949
> +    if (!result) {
> +        // We have a unset property.
> +        ASSERT(!conditionSet.numberOfConditionsWithKind(PropertyCondition::Presence));
> +        return GetByOffsetMethod::constant(m_constantUndefined);
> +    }

Can this go inside the switch?

[Filip Pizlo]

Comment on attachment 281376 [details]
Patch

Can you add a comment in DFGMultiGetByoffsetData.h, at GetByOffsetMethod, that constant may be due to unset?  I don't think it's likely that phases will differentiate between unset and constant, but if they do, we want to remember this quirk.  r=me but cq- because I think you should make that change.

[Keith Miller]

Comment on attachment 281376 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=281376&action=review

>> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:2949
>> +    }
> 
> Can this go inside the switch?

I don't think so since we might have a prototype load which needs a absence in the middle. For example, we are loading foo from a, where a's prototype chain looks like a -> b -> c and c has the property foo. We would need to have an absence condition for foo on b in a set that contains a presence condition on c.

[Keith Miller]

Created attachment 281378 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 281378 [details]
Patch for landing

Clearing flags on attachment: 281378

Committed r202101: <http://trac.webkit.org/changeset/202101>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.