[webkit-reviews] review denied: [Bug 98898] Support op_typeof in the DFG : [Attachment 178875] Patch

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Oliver Hunt <oliver at apple.com>'s
request for review:
Bug 98898: Support op_typeof in the DFG
https://bugs.webkit.org/show_bug.cgi?id=98898

Attachment 178875: Patch
https://bugs.webkit.org/attachment.cgi?id=178875&action=review

------- Additional Comments from Filip Pizlo <fpizlo at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=178875&action=review


You're almost there.  Just fix the CFA (AbstractState) to filter the same way
that the codegen speculates.

> Source/JavaScriptCore/dfg/DFGAbstractState.cpp:736
> +	   node.setCanExit(true);
> +	   forNode(nodeIndex).set(SpecString);

Somewhere in here you should filter according to the speculations that the
codegen does.  Like, if codegen speculates cell, this should filter cell.  Same
for string, etc.