[webkit-reviews] review denied: [Bug 179821] Update DFGSafeToExecute to be aware that ArrayPush is now a varargs node : [Attachment 327179] Patch

[bugzilla-daemon at webkit.org]

Saam Barati <sbarati at apple.com> has denied  review:
Bug 179821: Update DFGSafeToExecute to be aware that ArrayPush is now a varargs
node
https://bugs.webkit.org/show_bug.cgi?id=179821

Attachment 327179: Patch

https://bugs.webkit.org/attachment.cgi?id=327179&action=review




--- Comment #7 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 327179
  --> https://bugs.webkit.org/attachment.cgi?id=327179
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=327179&action=review

> Source/JavaScriptCore/dfg/DFGSafeToExecute.h:474
> +    case ArrayPush:
> +	   return node->arrayMode().alreadyChecked(graph, node,
state.forNode(graph.varArgChild(node, 1)));

varArgChild(node, 1) is not equivalent to child1(). varArgChild(node, 0) is
equivalent to child1() (ah, DFG naming).
You should make sure this is doing what you expect.