Title: [197196] trunk/Source/_javascript_Core
- Revision
- 197196
- Author
- [email protected]
- Date
- 2016-02-26 13:43:09 -0800 (Fri, 26 Feb 2016)
Log Message
Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
https://bugs.webkit.org/show_bug.cgi?id=154743
Reviewed by Mark Lam.
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (197195 => 197196)
--- trunk/Source/_javascript_Core/ChangeLog 2016-02-26 21:32:22 UTC (rev 197195)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-02-26 21:43:09 UTC (rev 197196)
@@ -1,5 +1,17 @@
2016-02-26 Keith Miller <[email protected]>
+ Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
+ https://bugs.webkit.org/show_bug.cgi?id=154743
+
+ Reviewed by Mark Lam.
+
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+
+2016-02-26 Keith Miller <[email protected]>
+
Native Typed Array functions should use Symbol.species
https://bugs.webkit.org/show_bug.cgi?id=154569
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (197195 => 197196)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2016-02-26 21:32:22 UTC (rev 197195)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2016-02-26 21:43:09 UTC (rev 197196)
@@ -553,6 +553,24 @@
break;
}
+ case OverridesHasInstance: {
+ if (!node->child2().node()->isCellConstant())
+ break;
+
+ if (node->child2().node()->asCell() != m_graph.globalObjectFor(node->origin.semantic)->functionProtoHasInstanceSymbolFunction()) {
+ m_graph.convertToConstant(node, jsBoolean(true));
+ changed = true;
+
+ } else if (!m_graph.hasExitSite(node->origin.semantic, BadTypeInfoFlags)) {
+ // We optimistically assume that we will not see a function that has a custom instanceof operation as they should be rare.
+ m_insertionSet.insertNode(indexInBlock, SpecNone, CheckTypeInfoFlags, node->origin, OpInfo(ImplementsDefaultHasInstance), Edge(node->child1().node(), CellUse));
+ m_graph.convertToConstant(node, jsBoolean(false));
+ changed = true;
+ }
+
+ break;
+ }
+
case Check: {
alreadyHandled = true;
m_interpreter.execute(indexInBlock);
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (197195 => 197196)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-02-26 21:32:22 UTC (rev 197195)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-02-26 21:43:09 UTC (rev 197196)
@@ -1093,26 +1093,7 @@
break;
}
- case OverridesHasInstance: {
- if (node->child2().node()->isCellConstant()) {
- if (node->child2().node()->asCell() != m_graph.globalObjectFor(node->origin.semantic)->functionProtoHasInstanceSymbolFunction()) {
-
- m_graph.convertToConstant(node, jsBoolean(true));
- break;
- }
-
- if (!m_graph.hasExitSite(node->origin.semantic, BadTypeInfoFlags)) {
- // Here we optimistically assume that we will not see an bound/C-API function here.
- m_insertionSet.insertNode(m_indexInBlock, SpecNone, CheckTypeInfoFlags, node->origin, OpInfo(ImplementsDefaultHasInstance), Edge(node->child1().node(), CellUse));
- m_graph.convertToConstant(node, jsBoolean(false));
- break;
- }
- }
-
- fixEdge<CellUse>(node->child1());
- break;
- }
-
+ case OverridesHasInstance:
case CheckStructure:
case CheckCell:
case CreateThis:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
