[webkit-reviews] review requested: [Bug 229543] [JSC] ASSERT failed in stress/for-in-tests.js (32bit) : [Attachment 438060] v6

[bugzilla-daemon at webkit.org]

Xan Lopez <xan.lopez at gmail.com> has asked  for review:
Bug 229543: [JSC] ASSERT failed in stress/for-in-tests.js (32bit)
https://bugs.webkit.org/show_bug.cgi?id=229543

Attachment 438060: v6

https://bugs.webkit.org/attachment.cgi?id=438060&action=review




--- Comment #15 from Xan Lopez <xan.lopez at gmail.com> ---
Created attachment 438060

  --> https://bugs.webkit.org/attachment.cgi?id=438060&action=review

v6

- the FixUp phase was already setting CellUse for the base, so no changes
there.
- get rid of the ManualOperandSpeculation args.
- add a comment clarifying what's the reason for the extra branch in the
CommonSlowPaths method, with a reference to the bug to get rid of it again.