[webkit-reviews] review granted: [Bug 186460] [DFG][FTL] Spread onto PhantomNewArrayBuffer assumes JSFixedArray, but JSImmutableButterfly is returned : [Attachment 342801] Patch

[bugzilla-daemon at webkit.org]

Saam Barati <sbarati at apple.com> has granted Yusuke Suzuki
<utatane.tea at gmail.com>'s request for review:
Bug 186460: [DFG][FTL] Spread onto PhantomNewArrayBuffer assumes JSFixedArray,
but JSImmutableButterfly is returned
https://bugs.webkit.org/show_bug.cgi?id=186460

Attachment 342801: Patch

https://bugs.webkit.org/attachment.cgi?id=342801&action=review




--- Comment #2 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 342801
  --> https://bugs.webkit.org/attachment.cgi?id=342801
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=342801&action=review

r=me

> Source/JavaScriptCore/ChangeLog:8
> +	   Spread(PhantomNewArrayBuffer) returns JSImmutableButterfly. But it
is wrong.

Do we do the right thing when we exit for PhantomSpread(PhantomNewArrayBuffer)?

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5718
> +	       ValueFromBlock slowFixedArray = m_out.anchor(vmCall(Int64,
m_out.operation(operationCreateFixedArray), m_callFrame,
m_out.constInt32(immutableButterfly->length())));

IntPtr

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5722
> +	       LValue fixedArray = m_out.phi(Int64, fastFixedArray,
slowFixedArray);

IntPtr