Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
https://bugs.webkit.org/show_bug.cgi?id=154743
Reviewed by Mark Lam.
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@197196 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 6a4eb13..2265c10 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -1093,26 +1093,7 @@
break;
}
- case OverridesHasInstance: {
- if (node->child2().node()->isCellConstant()) {
- if (node->child2().node()->asCell() != m_graph.globalObjectFor(node->origin.semantic)->functionProtoHasInstanceSymbolFunction()) {
-
- m_graph.convertToConstant(node, jsBoolean(true));
- break;
- }
-
- if (!m_graph.hasExitSite(node->origin.semantic, BadTypeInfoFlags)) {
- // Here we optimistically assume that we will not see an bound/C-API function here.
- m_insertionSet.insertNode(m_indexInBlock, SpecNone, CheckTypeInfoFlags, node->origin, OpInfo(ImplementsDefaultHasInstance), Edge(node->child1().node(), CellUse));
- m_graph.convertToConstant(node, jsBoolean(false));
- break;
- }
- }
-
- fixEdge<CellUse>(node->child1());
- break;
- }
-
+ case OverridesHasInstance:
case CheckStructure:
case CheckCell:
case CreateThis:
