[webkit-reviews] review denied: [Bug 195279] DFG should not force KnownInt32 edges during fixup : [Attachment 363851] Patch

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Tadeu Zagallo <tzagallo at apple.com>'s
request for review:
Bug 195279: DFG should not force KnownInt32 edges during fixup
https://bugs.webkit.org/show_bug.cgi?id=195279

Attachment 363851: Patch

https://bugs.webkit.org/attachment.cgi?id=363851&action=review




--- Comment #18 from Filip Pizlo <fpizlo at apple.com> ---
Comment on attachment 363851
  --> https://bugs.webkit.org/attachment.cgi?id=363851
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=363851&action=review

Currently this will push the same value more than once if you fail speculation,
or it will leave the array in a mode where elements past the length are not
holes.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:8599
> +	       if (node->arrayMode().type() == Array::Int32)
> +		   speculate(node, element);

This needs to be a separate pass, before you do anything to the array. 
Probably same issue in the FTL.