DFG should not emit function checks if we've already proved that the operand is that exact function
https://bugs.webkit.org/show_bug.cgi?id=101885
Reviewed by Oliver Hunt.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::filterByValue):
(AbstractValue):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134313 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 92739ee..54066f8 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -1572,11 +1572,22 @@
forNode(node.child1()).filter(SpecCell);
break;
- case CheckFunction:
+ case CheckFunction: {
+ JSValue value = forNode(node.child1()).value();
+ if (value == node.function()) {
+ m_foundConstants = true;
+ ASSERT(value);
+ node.setCanExit(false);
+ break;
+ }
+
node.setCanExit(true); // Lies! We can do better.
- forNode(node.child1()).filter(SpecFunction);
- // FIXME: Should be able to propagate the fact that we know what the function is.
+ if (!forNode(node.child1()).filterByValue(node.function())) {
+ m_isValid = false;
+ break;
+ }
break;
+ }
case PutById:
case PutByIdDirect:
