| Summary: | [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Yusuke Suzuki <ysuzuki> | ||||||
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | buildbot, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Attachments: |
|
||||||||
Created attachment 320261 [details]
Patch
Created attachment 320263 [details]
Patch
Comment on attachment 320263 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=320263&action=review > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:3175 > + JSValueRegs resultRegs = result.regs(); Is it worth using the FlushedCallResult (I forget actual class name) here? Comment on attachment 320263 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=320263&action=review >> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:3175 >> + JSValueRegs resultRegs = result.regs(); > > Is it worth using the FlushedCallResult (I forget actual class name) here? Sounds good. Fixed. Committed r221783: <http://trac.webkit.org/changeset/221783> |
We can find the code like, var dispatchTable = { "xxx": function () { ... }, "yyy": ..., ... }; dispatchTable[xxx]() In the above case, we can easily find 1. dispatchTable is Cell 2. xxx is String I find it in Octane/TypeScript. Currently, we always go to operationGetByVal, which is too generic method.