diff options
Diffstat (limited to 'Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp')
| -rw-r--r-- | Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp index 25915cfd4..43aa2c007 100644 --- a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp +++ b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp @@ -92,10 +92,22 @@ private: } case CheckStructure: - case ForwardCheckStructure: { + case ForwardCheckStructure: + case ArrayifyToStructure: { AbstractValue& value = m_state.forNode(node.child1()); + StructureSet set; + if (node.op() == ArrayifyToStructure) + set = node.structure(); + else + set = node.structureSet(); + if (value.m_currentKnownStructure.isSubsetOf(set)) { + ASSERT(node.refCount() == 1); + node.setOpAndDefaultFlags(Phantom); + eliminated = true; + break; + } StructureAbstractValue& structureValue = value.m_futurePossibleStructure; - if (structureValue.isSubsetOf(node.structureSet()) + if (structureValue.isSubsetOf(set) && structureValue.hasSingleton() && isCellSpeculation(value.m_type)) node.convertToStructureTransitionWatchpoint(structureValue.singleton()); @@ -104,7 +116,7 @@ private: case CheckArray: case Arrayify: { - if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode())) + if (!node.arrayMode().alreadyChecked(m_state.forNode(node.child1()))) break; ASSERT(node.refCount() == 1); node.setOpAndDefaultFlags(Phantom); |