[webkit-reviews] review granted: [Bug 193127] Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate : [Attachment 358590] Patch

[bugzilla-daemon at webkit.org]

Saam Barati <sbarati at apple.com> has granted Yusuke Suzuki
<yusukesuzuki at slowstart.org>'s request for review:
Bug 193127: Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate
https://bugs.webkit.org/show_bug.cgi?id=193127

Attachment 358590: Patch

https://bugs.webkit.org/attachment.cgi?id=358590&action=review




--- Comment #6 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 358590
  --> https://bugs.webkit.org/attachment.cgi?id=358590
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=358590&action=review

r=me

> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:1402
> +	       if (!(child.m_type & SpecOther)) {
> +		   setConstant(node, jsBoolean(false));
> +		   constantWasSet = true;
> +		   break;
> +	       }

You should also have a rule for
!(child.m_type & ~SpecOther) => true