tree 31451d7b453db93ebc223fd4dc9225ccdaaed9b3
parent c91666578eb66df1bc73eab4760fe768fd342adc
author ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575527166 +0000
committer ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575527166 +0000

[JSC] AI should convert IsCellWithType to constant when Structure set is finite
https://bugs.webkit.org/show_bug.cgi?id=204141

Reviewed by Mark Lam.

JSTests:

* stress/generator-cell-with-type.js: Added.
(shouldBe):
(shouldThrow):
(test):
(i.shouldThrow):
* stress/is-cell-with-type-should-check-non-cell-cases.js: Added.
(getter):
(foo):

Source/JavaScriptCore:

We should fold IsCellWithType if Structure set is finite since we have a chance to know what JSType is.
The difference from the last patch is that we have `if (!(child.m_type & ~SpecCell))` check. Even if
structures meet the requirement, this structures do not guarantee that non cell types never come. We
should ensure it by using proven type.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@253144 268f45cc-cd09-0410-ab3c-d52691b4dbfc