[webkit-reviews] review granted: [Bug 209824] REGRESSION: ASSERTION FAILED: regExpObjectNode in JSC::DFG::StrengthReductionPhase::handleNode : [Attachment 395082] Patch

[bugzilla-daemon at webkit.org]

Mark Lam <mark.lam at apple.com> has granted Ross Kirsling
<ross.kirsling at sony.com>'s request for review:
Bug 209824: REGRESSION: ASSERTION FAILED: regExpObjectNode in
JSC::DFG::StrengthReductionPhase::handleNode
https://bugs.webkit.org/show_bug.cgi?id=209824

Attachment 395082: Patch

https://bugs.webkit.org/attachment.cgi?id=395082&action=review




--- Comment #7 from Mark Lam <mark.lam at apple.com> ---
Comment on attachment 395082
  --> https://bugs.webkit.org/attachment.cgi?id=395082
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395082&action=review

r=me

>> Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:556
>> +			    lastIndex =
static_cast<unsigned>(otherNode->child2()->asInt32());
> 
> Moved code, not new. This seems a lot like isUInt32/asUInt32 and a little
strange that we’re using static_cast instead.

Yes, let's just use asUint32() and remove the need for the cast.