[webkit-reviews] review granted: [Bug 123778] internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249 : [Attachment 215992] the patch

[bugzilla-daemon at webkit.org]

Geoffrey Garen <ggaren at apple.com> has granted Filip Pizlo <fpizlo at apple.com>'s
request for review:
Bug 123778: internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default:
ASSERTION FAILED:
m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(struct
ure)) at DFGConstantFoldingPhase.cpp:249
https://bugs.webkit.org/show_bug.cgi?id=123778

Attachment 215992: the patch
https://bugs.webkit.org/attachment.cgi?id=215992&action=review

------- Additional Comments from Geoffrey Garen <ggaren at apple.com>
r=me