GetById->GetByOffset and PutById->PutByOffset folding should mark haveStructures since it may result in structure transition watchpoints
https://bugs.webkit.org/show_bug.cgi?id=123788
Reviewed by Geoffrey Garen.
haveStructures is true if there are any currentlyKnownStructures that have
interesting values, since that's the only time when clobbering needs to do things.
It's a really important compile-time optimization. But that also means that anytime
we might cause currentlyKnownStructures to get set - like when we might insert some
structure transition watchpoints - we need to set haveStructures. We were forgetting
to do that for GetById->GetByOffset and PutById->PutByOffset because, I guess, we
forgot that those might insert structure transition watchpoints.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158680 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
index 42fea04..09fd14a 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -1282,6 +1282,7 @@
filter(node->child1(), status.structureSet());
m_state.setFoundConstants(true);
+ m_state.setHaveStructures(true);
break;
}
}
@@ -1479,6 +1480,7 @@
if (status.isSimpleReplace()) {
filter(node->child1(), structure);
m_state.setFoundConstants(true);
+ m_state.setHaveStructures(true);
break;
}
if (status.isSimpleTransition()) {
