[webkit-reviews] review granted: [Bug 106074] DFG should not elide CheckStructure if it's needed to perform a cell check : [Attachment 181262] the patch

[bugzilla-daemon at webkit.org]

Ryosuke Niwa <rniwa at webkit.org> has granted Filip Pizlo <fpizlo at apple.com>'s
request for review:
Bug 106074: DFG should not elide CheckStructure if it's needed to perform a
cell check
https://bugs.webkit.org/show_bug.cgi?id=106074

Attachment 181262: the patch
https://bugs.webkit.org/attachment.cgi?id=181262&action=review

------- Additional Comments from Ryosuke Niwa <rniwa at webkit.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=181262&action=review


r=me. Despite the fact I’m not an expert of JSC, I think Filip explained me
enough details to know what’s happening here.

> Source/JavaScriptCore/ChangeLog:3
> +	   

Please add the bug title here.

> Source/JavaScriptCore/ChangeLog:9
> +	   * dfg/DFGConstantFoldingPhase.cpp:
> +	   (JSC::DFG::ConstantFoldingPhase::foldConstants):

It’ll be great if you could explain what you’ve described me in person
(probably in some brief sentence).

> Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:107
> +		   if (!isCellSpeculation(value.m_type))
> +		       break;
>		   if (value.m_currentKnownStructure.isSubsetOf(set)) {

I wonder if you can add isSubsetOf that takes value and ASSERT that
isCellSpeculation or whatever condition needed is true.