Bug 170940 - [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
Summary: [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking ...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
Depends on:
Reported: 2017-04-18 04:02 PDT by Yusuke Suzuki
Modified: 2017-04-18 08:39 PDT (History)
6 users (show)

See Also:

Patch (4.18 KB, patch)
2017-04-18 05:09 PDT, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (4.18 KB, patch)
2017-04-18 05:32 PDT, Yusuke Suzuki
fpizlo: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yusuke Suzuki 2017-04-18 04:02:45 PDT
Comment 1 Yusuke Suzuki 2017-04-18 04:06:13 PDT
I'm not sure why not using Phantom.
Comment 2 Yusuke Suzuki 2017-04-18 05:09:14 PDT
Created attachment 307375 [details]
Comment 3 Yusuke Suzuki 2017-04-18 05:32:39 PDT
Created attachment 307376 [details]
Comment 4 Yusuke Suzuki 2017-04-18 08:05:02 PDT
Committed r215459: <http://trac.webkit.org/changeset/215459>
Comment 5 Yusuke Suzuki 2017-04-18 08:28:04 PDT
Comment on attachment 307376 [details]

View in context: https://bugs.webkit.org/attachment.cgi?id=307376&action=review

> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:3618
> +                addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter);

Oops, CheckCell can OSRExit, so we need to insert Phantom after CheckCell. I'll land the follow up patch that just replaces the positions between CheckCell and Phantom.
Comment 6 Yusuke Suzuki 2017-04-18 08:39:55 PDT
Committed r215460: <http://trac.webkit.org/changeset/215460>