[webkit-reviews] review denied: [Bug 195279] DFG should not force KnownInt32 edges during fixup : [Attachment 363786] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Mar 6 17:15:09 PST 2019

Saam Barati <sbarati at apple.com> has denied Tadeu Zagallo <tzagallo at apple.com>'s
request for review:
Bug 195279: DFG should not force KnownInt32 edges during fixup

Attachment 363786: Patch


--- Comment #13 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 363786
  --> https://bugs.webkit.org/attachment.cgi?id=363786

View in context: https://bugs.webkit.org/attachment.cgi?id=363786&action=review

Are all the other nodes vetted? I think you still have that StrictInt32 crap
that needs to be removed for the EnumeratorPName.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:8562
> +		   JSValueOperand value(this, element,
> +		   valueRegs = value.jsValueRegs();
> +	       }

You should remove the above if and just call speculate(...) here

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4668
> +		       value = boxInt32(lowInt32(element));

just call: speculate(element)

You're still missing code for the elemntCount > 1 case

More information about the webkit-reviews mailing list