[webkit-reviews] review denied: [Bug 103727] Unset NodeMustGenerate flag for Call nodes of few String.prototype.* pure functions : [Attachment 176931] patch

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Dmitry Melnik <dm at ispras.ru>'s
request for review:
Bug 103727: Unset NodeMustGenerate flag for Call nodes of few
String.prototype.* pure functions
https://bugs.webkit.org/show_bug.cgi?id=103727

Attachment 176931: patch
https://bugs.webkit.org/attachment.cgi?id=176931&action=review

------- Additional Comments from Filip Pizlo <fpizlo at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=176931&action=review


> Source/JavaScriptCore/dfg/DFGAbstractState.cpp:2045
> +    node.clearFlags(NodeMustGenerate);

It's not correct to do this inside AbstractState - since you have no way of
knowing , yet, if the CFA has converged and if the function value you're
relying upon is accurate. 

Instead, you should just move this whole method to the constant folding phase.
(I know, really bad name for a phase since it does more than constant
folding.). That phase runs after CFA converges so you can be sure that the
function is accurate.