...
I'm not sure why not using Phantom.
Created attachment 307375 [details] Patch
Created attachment 307376 [details] Patch
Committed r215459: <http://trac.webkit.org/changeset/215459>
Comment on attachment 307376 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=307376&action=review > Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:3618 > + addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter); Oops, CheckCell can OSRExit, so we need to insert Phantom after CheckCell. I'll land the follow up patch that just replaces the positions between CheckCell and Phantom.
Committed r215460: <http://trac.webkit.org/changeset/215460>