[webkit-reviews] review denied: [Bug 112106] REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit : [Attachment 195144] Patch

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Mark Hahnenberg
<mhahnenberg at apple.com>'s request for review:
Bug 112106: REGRESSION(r144131): It made
fast/js/regress/string-repeat-arith.html assert on 32 bit
https://bugs.webkit.org/show_bug.cgi?id=112106

Attachment 195144: Patch
https://bugs.webkit.org/attachment.cgi?id=195144&action=review

------- Additional Comments from Filip Pizlo <fpizlo at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=195144&action=review


> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2107
> -	       terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
> +	       m_compileOkay = false;

I think this is wrong.	What if this is the first node to type check the child?
 Then with your change, we'll tell the compiler that we stopped compiling even
though the code is totally reachable.