Currently, structure check hoisting runs after the DFG optimization fixpoint. But when it modifies the IR (which is currently almost always, since array checks have been turned into structure checks), it requires the CFA to be rerun, outside of the fixpoint. Also, structure check hoisting requires that the post-fixpoint CSE fixes up redundant GetLocals introduced by hoisting. But there's no reason why structure check hoisting can't run before the optimization fixpoint. There's also no reason why structure check hoisting can't just clean up after itself to eliminate the need for CSE to worry about redundant GetLocals on non-captured variables.
Created attachment 158739 [details] the patch
Attachment 158739 [details] did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source..." exit_code: 1 Source/JavaScriptCore/dfg/DFGGraph.h:635: This { should be at the end of the previous line [whitespace/braces] [4] Total errors found: 1 in 6 files If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 158742 [details] the patch Fix style.
Comment on attachment 158742 [details] the patch r=me
Landed in http://trac.webkit.org/changeset/125823