[webkit-reviews] review denied: [Bug 195279] DFG should not force KnownInt32 edges during fixup : [Attachment 363786] Patch

[bugzilla-daemon at webkit.org]

Saam Barati <sbarati at apple.com> has denied Tadeu Zagallo <tzagallo at apple.com>'s
request for review:
Bug 195279: DFG should not force KnownInt32 edges during fixup
https://bugs.webkit.org/show_bug.cgi?id=195279

Attachment 363786: Patch

https://bugs.webkit.org/attachment.cgi?id=363786&action=review




--- Comment #13 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 363786
  --> https://bugs.webkit.org/attachment.cgi?id=363786
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=363786&action=review

Are all the other nodes vetted? I think you still have that StrictInt32 crap
that needs to be removed for the EnumeratorPName.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:8562
> +		   JSValueOperand value(this, element,
ManualOperandSpeculation);
> +		   valueRegs = value.jsValueRegs();
> +	       }

You should remove the above if and just call speculate(...) here

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4668
> +		       value = boxInt32(lowInt32(element));

just call: speculate(element)

You're still missing code for the elemntCount > 1 case