Patch forthcoming.
Created attachment 223912 [details] work in progress
Created attachment 223929 [details] almost done I would test this except I'm blocked on https://bugs.webkit.org/show_bug.cgi?id=128635.
Created attachment 223943 [details] more!! It successfully eliminated some overflow checks
Attachment 223943 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/dfg/DFGIntegerCheckHoistingPhase.cpp:30: You should not add a blank line before implementation file's own header. [build/include_order] [4] ERROR: Source/JavaScriptCore/dfg/DFGIntegerCheckHoistingPhase.cpp:287: When wrapping a line, only indent 4 spaces. [whitespace/indent] [3] ERROR: Source/JavaScriptCore/dfg/DFGIntegerCheckHoistingPhase.cpp:310: When wrapping a line, only indent 4 spaces. [whitespace/indent] [3] Total errors found: 3 in 33 files If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 224020 [details] the patch
Comment on attachment 224020 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=224020&action=review r=me > Source/JavaScriptCore/dfg/DFGAbstractValue.cpp:77 > m_futurePossibleStructure.clear(); > m_arrayModes = 0; > } > - > + > m_type = speculationFromValue(value); > if (m_type == SpecInt52AsDouble) > m_type = SpecInt52; > m_value = value; > - > + > checkConsistency(); > } > Revert. > Source/JavaScriptCore/dfg/DFGInsertionSet.h:62 > { > return insert(Insertion(index, element)); > } > - > + > #define DFG_DEFINE_INSERT_NODE(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs) \ > templatePre typeParams templatePost Node* insertNode(size_t index, SpeculatedType type valueParamsComma valueParams) \ > { \ Revert.
Landed in http://trac.webkit.org/changeset/164059