[Webkit-unassigned] [Bug 103727] Unset NodeMustGenerate flag for Call nodes of few String.prototype.* pure functions

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=103727


Filip Pizlo <fpizlo at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #176931|review?                     |review-, commit-queue-
               Flag|                            |




--- Comment #2 from Filip Pizlo <fpizlo at apple.com>  2012-11-30 12:11:25 PST ---
(From update of attachment 176931)
View in context: https://bugs.webkit.org/attachment.cgi?id=176931&action=review

> Source/JavaScriptCore/dfg/DFGAbstractState.cpp:2045
> +    node.clearFlags(NodeMustGenerate);

It's not correct to do this inside AbstractState - since you have no way of knowing , yet, if the CFA has converged and if the function value you're relying upon is accurate. 

Instead, you should just move this whole method to the constant folding phase. (I know, really bad name for a phase since it does more than constant folding.). That phase runs after CFA converges so you can be sure that the function is accurate.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.