[Webkit-unassigned] [Bug 175610] Teach DFGFixupPhase.cpp that the current scope is always a cell

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=175610

Keith Miller <keith_miller at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #318421|review?, commit-queue?      |review+, commit-queue-
              Flags|                            |

--- Comment #9 from Keith Miller <keith_miller at apple.com> ---
Comment on attachment 318421
  --> https://bugs.webkit.org/attachment.cgi?id=318421
Patch, with FTL fixed, now passes test locally

View in context: https://bugs.webkit.org/attachment.cgi?id=318421&action=review

r=me with some minor changes.

> Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:1717
> +            fixEdge<KnownCellUse>(node->child1());

I would change this to ObjectUse and make a FIXME to add KnownObjectUse.

> Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:1723
> +            fixEdge<KnownCellUse>(node->child1());

Ditto.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1146
> +        JSValueOperand object(this, node->child2());

Nit: this could be objectEdge.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170817/32086222/attachment.html>