Here's the IR: a: Foo() b: SetLocal(@a, r1 c: CheckStructure(@a, <blah>) d: PutStructure(@a, <blih>) e: CheckStructure(@a, <blih>) Some other block: f: GetLocal(r1) g: CheckStructure(@a, <blih>) If we hoist the structure check for structure <blih>, we'll end up always OSR exiting since at the point of @b, the structure is still <blah>. The reason for this omission in the due diligence of structure check hoister is that while it looks at all CheckStructures on GetLocals on r1, it fails to look at CheckStructures on @a.
Created attachment 164298 [details] the patch
Landed in http://trac.webkit.org/changeset/128699
(In reply to comment #2) > Landed in http://trac.webkit.org/changeset/128699 It made 2 tests assert on Qt - https://bugs.webkit.org/show_bug.cgi?id=96907 Could you check it, please?
(In reply to comment #3) > (In reply to comment #2) > > Landed in http://trac.webkit.org/changeset/128699 > > It made 2 tests assert on Qt - https://bugs.webkit.org/show_bug.cgi?id=96907 > Could you check it, please? I'm on it. It's confusing though - I don't see the assertions on Mac.