Bug 170940

Summary: [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: buildbot, fpizlo, keith_miller, mark.lam, msaboff, saam
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch fpizlo: review+

Yusuke Suzuki
Reported 2017-04-18 04:02:45 PDT
...
Attachments
Patch (4.18 KB, patch)
2017-04-18 05:09 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Patch (4.18 KB, patch)
2017-04-18 05:32 PDT, Yusuke Suzuki 		fpizlo: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2017-04-18 04:06:13 PDT
I'm not sure why not using Phantom.
Yusuke Suzuki
Comment 2 2017-04-18 05:09:14 PDT
Created attachment 307375 [details] Patch
Yusuke Suzuki
Comment 3 2017-04-18 05:32:39 PDT
Created attachment 307376 [details] Patch
Yusuke Suzuki
Comment 4 2017-04-18 08:05:02 PDT
Committed r215459: <http://trac.webkit.org/changeset/215459>
Yusuke Suzuki
Comment 5 2017-04-18 08:28:04 PDT
Comment on attachment 307376 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=307376&action=review > Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:3618 > + addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter); Oops, CheckCell can OSRExit, so we need to insert Phantom after CheckCell. I'll land the follow up patch that just replaces the positions between CheckCell and Phantom.
Yusuke Suzuki
Comment 6 2017-04-18 08:39:55 PDT
Committed r215460: <http://trac.webkit.org/changeset/215460>
Note You need to log in before you can comment on or make changes to this bug.