[webkit-reviews] review denied: [Bug 70384] Support CanvasPixelArray in the DFG : [Attachment 111534] Patch

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Oliver Hunt <oliver at apple.com>'s
request for review:
Bug 70384: Support CanvasPixelArray in the DFG
https://bugs.webkit.org/show_bug.cgi?id=70384

Attachment 111534: Patch
https://bugs.webkit.org/attachment.cgi?id=111534&action=review

------- Additional Comments from Filip Pizlo <fpizlo at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=111534&action=review


> Source/JavaScriptCore/dfg/DFGAbstractState.cpp:344
> +	       filter = PredictByteArray;

That's wrong, since you didn't implement the equivalent case in SpeculativeJIT.
 This case for Array is here because SpeculativeJIT::compare() may filter on
arrays.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:1330
> +	   if (at(node.child1()).prediction() == PredictByteArray) {

Call isByteArrayPrediction

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:1392
> +	   if (at(node.child1()).prediction() & PredictByteArray) {

Does the abstract state do the same thing?

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:1462
> +	   if (at(node.child1()).prediction() & PredictByteArray) {

Does the abstract state do the same thing?

> Source/JavaScriptCore/wtf/ByteArray.cpp:28
> +

kill!