[webkit-reviews] review granted: [Bug 105139] Rationalize array profiling for out-of-bounds and hole cases : [Attachment 179681] the patch

[bugzilla-daemon at webkit.org]

Geoffrey Garen <ggaren at apple.com> has granted Filip Pizlo <fpizlo at apple.com>'s
request for review:
Bug 105139: Rationalize array profiling for out-of-bounds and hole cases
https://bugs.webkit.org/show_bug.cgi?id=105139

Attachment 179681: the patch
https://bugs.webkit.org/attachment.cgi?id=179681&action=review

------- Additional Comments from Geoffrey Garen <ggaren at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=179681&action=review


r=me

> Source/JavaScriptCore/bytecode/ArrayProfile.cpp:106
> +	   && !Heap::isMarked(m_expectedStructure))

Heap::isMarked() will be false if m_expectedStructure is newly allocated. (Not
new here, but seems like a potential bug.)