[webkit-reviews] review granted: [Bug 179594] [DFG][FTL] Support Array::DirectArguments with OutOfBounds : [Attachment 326876] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Nov 14 09:20:43 PST 2017


Saam Barati <sbarati at apple.com> has granted Yusuke Suzuki
<utatane.tea at gmail.com>'s request for review:
Bug 179594: [DFG][FTL] Support Array::DirectArguments with OutOfBounds
https://bugs.webkit.org/show_bug.cgi?id=179594

Attachment 326876: Patch

https://bugs.webkit.org/attachment.cgi?id=326876&action=review




--- Comment #5 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 326876
  --> https://bugs.webkit.org/attachment.cgi?id=326876
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=326876&action=review

> Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp:245
> +		      
m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);

Don’t you want to check OOB mode here? Or is the !prototypeChaneIsSane rare
enough that we just do it unconditionally?


More information about the webkit-reviews mailing list