Bug 176590 – [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Yusuke Suzuki]

We can find the code like,

var dispatchTable = {
   "xxx": function () { ... },
   "yyy": ...,
   ...
};


dispatchTable[xxx]()

In the above case, we can easily find

1. dispatchTable is Cell
2. xxx is String

I find it in Octane/TypeScript.

Currently, we always go to operationGetByVal, which is too generic method.

[Yusuke Suzuki]

Created attachment 320261 [details]
Patch

[Yusuke Suzuki]

Created attachment 320263 [details]
Patch

[Saam Barati]

Comment on attachment 320263 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=320263&action=review

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:3175
> +    JSValueRegs resultRegs = result.regs();

Is it worth using the FlushedCallResult (I forget actual class name) here?

[Yusuke Suzuki]

Comment on attachment 320263 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=320263&action=review

>> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:3175
>> +    JSValueRegs resultRegs = result.regs();
> 
> Is it worth using the FlushedCallResult (I forget actual class name) here?

Sounds good. Fixed.

[Yusuke Suzuki]

Committed r221783: <http://trac.webkit.org/changeset/221783>

[Radar WebKit Bug Importer]

<rdar://problem/34693620>