We should be checking if arrayModeForStructure(structure) is a subset of arrayModesThatPassFiltering(), not the other way around.
Created attachment 204075 [details] Patch
Comment on attachment 204075 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=204075&action=review > Source/JavaScriptCore/dfg/DFGArrayMode.h:366 > bool isContravenedByStructure(Structure* structure) Can we make it clearer that the thing that was proven was the structure? What about having a method called: structureWouldPassArrayModeFiltering(Structure*) RS=me to make a change like that
Committed r151468: <http://trac.webkit.org/changeset/151468>