The DFG backend should not make assumptions about what optimizations the front end will or will not do. The assertion asserts that the operand cannot be known to be a cell. However, it is not guaranteed that the front end will fold away this case. Also, the DFG backend is perfectly capable of generating code to handle the case where the operand is a cell. <rdar://problem/48976951>
Created attachment 365639 [details] proposed patch.
Comment on attachment 365639 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=365639&action=review > Source/JavaScriptCore/ChangeLog:10 > + The DFG backend should not make assumptions about what optimizations the front end > + will or will not do. The assertion asserts that the operand cannot be known to be You're right - the DFG is making a back assumption here because optimizations should be optional.
(In reply to Filip Pizlo from comment #2) > Comment on attachment 365639 [details] > proposed patch. > > View in context: > https://bugs.webkit.org/attachment.cgi?id=365639&action=review > > > Source/JavaScriptCore/ChangeLog:10 > > + The DFG backend should not make assumptions about what optimizations the front end > > + will or will not do. The assertion asserts that the operand cannot be known to be > > You're right - the DFG is making a back assumption here because > optimizations should be optional. *bad assumption
Thanks for the review. Landed in r243344: <http://trac.webkit.org/r243344>.
Comment on attachment 365639 [details] proposed patch. LGTM too.