[Webkit-unassigned] [Bug 205147] New: FTL expects String.prototype to not qualify for StringObjectUse.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=205147

            Bug ID: 205147
           Summary: FTL expects String.prototype to not qualify for
                    StringObjectUse.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

Currently, String.prototype's JSType is StringObjectType.

However, in the compiler, there are a few places that expect that the String.prototype value to not qualify as StringObjectUse.  These places are:
1. SpeculatedType.cpp's speculationFromClassInfo() will speculate SpecObjectOther for the StringPrototype object.
2. DFGFixupPhase.cpp's addCheckStructureForOriginalStringObjectUse() only does a CheckStructure against globalObject->stringObjectStructure().  It does not check against String.prototype's structure.

To resolve this discrepancy, we can either do:
a. change String.prototype's JSType to something else.
b. fix the places in the compiler to accept String.prototype as StringObjectUse.

(a) is trivial and cheap to do.  (b) is doable but will result in less optimal compiled code.  Since passing String.prototype as a StringObject is expected to be a rare thing in JS code, it's not worth incurring the cost for (b).  We'll apply (a).

<rdar://problem/57748888>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191212/25fc6c0a/attachment-0001.htm>