Bug 170940

Summary: [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: buildbot, fpizlo, keith_miller, mark.lam, msaboff, saam
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch fpizlo: review+

Description Yusuke Suzuki 2017-04-18 04:02:45 PDT 
...
Comment 1 Yusuke Suzuki 2017-04-18 04:06:13 PDT 
I'm not sure why not using Phantom.
Comment 2 Yusuke Suzuki 2017-04-18 05:09:14 PDT 
Created attachment 307375 [details]
Patch
Comment 3 Yusuke Suzuki 2017-04-18 05:32:39 PDT 
Created attachment 307376 [details]
Patch
Comment 4 Yusuke Suzuki 2017-04-18 08:05:02 PDT 
Committed r215459: <http://trac.webkit.org/changeset/215459>
Comment 5 Yusuke Suzuki 2017-04-18 08:28:04 PDT 
Comment on attachment 307376 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=307376&action=review

> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:3618
> +                addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter);

Oops, CheckCell can OSRExit, so we need to insert Phantom after CheckCell. I'll land the follow up patch that just replaces the positions between CheckCell and Phantom.
Comment 6 Yusuke Suzuki 2017-04-18 08:39:55 PDT 
Committed r215460: <http://trac.webkit.org/changeset/215460>