RESOLVED FIXED 170940
[DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object 
https://bugs.webkit.org/show_bug.cgi?id=170940
Summary [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking ...
Yusuke Suzuki
Reported 2017-04-18 04:02:45 PDT
...
Attachments
Patch (4.18 KB, patch)
2017-04-18 05:09 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Patch (4.18 KB, patch)
2017-04-18 05:32 PDT, Yusuke Suzuki 		fpizlo: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2017-04-18 04:06:13 PDT
I'm not sure why not using Phantom.
Yusuke Suzuki
Comment 2 2017-04-18 05:09:14 PDT
Created attachment 307375 [details] Patch
Yusuke Suzuki
Comment 3 2017-04-18 05:32:39 PDT
Created attachment 307376 [details] Patch
Yusuke Suzuki
Comment 4 2017-04-18 08:05:02 PDT
Committed r215459: <http://trac.webkit.org/changeset/215459>
Yusuke Suzuki
Comment 5 2017-04-18 08:28:04 PDT
Comment on attachment 307376 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=307376&action=review > Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:3618 > + addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter); Oops, CheckCell can OSRExit, so we need to insert Phantom after CheckCell. I'll land the follow up patch that just replaces the positions between CheckCell and Phantom.
Yusuke Suzuki
Comment 6 2017-04-18 08:39:55 PDT
Committed r215460: <http://trac.webkit.org/changeset/215460>
Note You need to log in before you can comment on or make changes to this bug.