[webkit-reviews] review denied: [Bug 195279] DFG should not force KnownInt32 edges during fixup : [Attachment 363851] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Mar 12 11:08:15 PDT 2019

Filip Pizlo <fpizlo at apple.com> has denied Tadeu Zagallo <tzagallo at apple.com>'s
request for review:
Bug 195279: DFG should not force KnownInt32 edges during fixup

Attachment 363851: Patch


--- Comment #18 from Filip Pizlo <fpizlo at apple.com> ---
Comment on attachment 363851
  --> https://bugs.webkit.org/attachment.cgi?id=363851

View in context: https://bugs.webkit.org/attachment.cgi?id=363851&action=review

Currently this will push the same value more than once if you fail speculation,
or it will leave the array in a mode where elements past the length are not

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:8599
> +	       if (node->arrayMode().type() == Array::Int32)
> +		   speculate(node, element);

This needs to be a separate pass, before you do anything to the array. 
Probably same issue in the FTL.

More information about the webkit-reviews mailing list