Currently, Symbol is classified as SpecCellOther. But this is too conservative analysis and there's room to optimize it. Introducing SpecSymbol and analyzing this type in DFG/FTL brings faster Symbol comparison and lookups with it. It will encourage some applications that uses Symbol as an unique key, like React.js.
CellOther is used for non-user-visible Cell objects. So current status (categorizing Symbol into CellOther type) is not correct.
Let's introduce SpecSymbol at first. In the separated patch, I'll introduce SymbolUse.
Created attachment 253121 [details] Patch
Comment on attachment 253121 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=253121&action=review > Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:454 > + if (m_state.forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol)) ToPrimitive is used in string concatnation. It is tested in tests/stress/dfg-to-primitive-pass-symbol.js
Comment on attachment 253121 [details] Patch Clearing flags on attachment: 253121 Committed r184340: <http://trac.webkit.org/changeset/184340>
All reviewed patches have been landed. Closing bug.