[Webkit-unassigned] [Bug 144176] Function allocation sinking works for wrong reasons

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144176

--- Comment #7 from Basile Clement <basile_clement at apple.com> ---
(In reply to comment #6)
> Comment on attachment 251764 [details]
> Seems to be doing the right thing
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=251764&action=review
> 
> >> Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:812
> >> +            if (target->op() != NewObject)
> > 
> > Unsure if I should add a helper function in DFG::Node for that...
> 
> Seems wrong - MaterializeNewObject is also a sink candidate.

Oh, duh, indeed. Fixing that, w/ a helper function then.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150427/07a88341/attachment.html>