[webkit-reviews] review granted: [Bug 209777] ASSERTION FAILED: m_cases[i - 1] < m_cases[I] due to DeleteIC. : [Attachment 395061] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Mar 31 10:21:42 PDT 2020


Mark Lam <mark.lam at apple.com> has granted Justin Michaud
<justin at justinmichaud.com>'s request for review:
Bug 209777: ASSERTION FAILED: m_cases[i - 1] < m_cases[I] due to DeleteIC.
https://bugs.webkit.org/show_bug.cgi?id=209777

Attachment 395061: Patch

https://bugs.webkit.org/attachment.cgi?id=395061&action=review




--- Comment #2 from Mark Lam <mark.lam at apple.com> ---
Comment on attachment 395061
  --> https://bugs.webkit.org/attachment.cgi?id=395061
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395061&action=review

r=me

> JSTests/ChangeLog:8
> +	   * stress/delete-property-ic-compatable.js: Added.

Can you also add variants of this test for the other proxy types?

> JSTests/stress/delete-property-ic-compatable.js:1
> +//@ requireOptions("--jitPolicyScale=0", "--useDFGJIT=0",
"--useConcurrentJIT=0")

I think you can drop the "--useConcurrentJIT=0".  There will be a test
configuration that handles that already.


More information about the webkit-reviews mailing list