Right now, some nodes type check with forward exit, while others do it with backward exit. Most nodes will use the same direction for all of their exits (the one exception is some typed array access). But the only way you can even get a hint of exit directionality is by casing on node type. This is sloppy, and could lead to bugs (if you replace a ForwardCheckStructure with a Phantom and intend to keep the cell check, you've now introduced a really bad bug). This patch fixes this by having a NodeFlag that tells the exit directionality.
Created attachment 190785 [details] the patch
Comment on attachment 190785 [details] the patch r=me
Comment on attachment 190785 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=190785&action=review > Source/JavaScriptCore/dfg/DFGNodeFlags.h:70 > +#define NodeExitsForward 0x10000 enum { NodeExitsForward = 0x10000 }? I've been leaning towards enums for constants lately as they're guaranteed to be constant (eg. no compiler deciding to do stupid loads) and are visible to the debugger
(In reply to comment #3) > (From update of attachment 190785 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=190785&action=review > > > Source/JavaScriptCore/dfg/DFGNodeFlags.h:70 > > +#define NodeExitsForward 0x10000 > > enum { NodeExitsForward = 0x10000 }? > > I've been leaning towards enums for constants lately as they're guaranteed to be constant (eg. no compiler deciding to do stupid loads) and are visible to the debugger Separate patch? DFGNodeFlags.h uses #define's extensively for all of the flags, and has been doing so since the DFG's beginning.
Landed in http://trac.webkit.org/changeset/144362