[Webkit-unassigned] [Bug 211796] New: Constant-fold common case of OpIsConstructor by speculating m_structure

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=211796

            Bug ID: 211796
           Summary: Constant-fold common case of OpIsConstructor by
                    speculating m_structure
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Enhancement
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: shvaikalesh at gmail.com

For many function “types” we could know if it’s constructible from the structure cell.
For example, JSStrictFunction is always constructible, while JSArrowFunction and JSGeneratorFunction are not.
Probably we would just store a TriState on the structure and if every structure flowing into the IsConstructor is either TriState::True or TriState::False we can fold to a constant.
It’s possible we could store this info on the method table too.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200512/5744271f/attachment-0001.htm>