IndexingType's hasAnyArrayStorage() currently does subtraction of ArrayStorageShape with the purpose of making non-ArrayStorage types underflow (with that subtraction) and have a result that exceeds SlowPutArrayStorageShape. What it is doing is basically checking for a shape value that is greater equal to ArrayStorageShape. We can just simplify the code as such.
Created attachment 240421 [details] the patch.
Comment on attachment 240421 [details] the patch. View in context: https://bugs.webkit.org/attachment.cgi?id=240421&action=review r=me Fix the comment issues. > Source/JavaScriptCore/runtime/IndexingType.h:39 > + struct IndextingType { Spelling of IndextingType > Source/JavaScriptCore/runtime/IndexingType.h:42 > + uint8_t maHaveIndexedShapes:1; // bit 5 Should this be mayHaveIndexedShapes?
Thanks. I also found 2 more errors in the comments (should not have tabs, and "mayHaveIndexedAccessors"instead of "mayHaveIndexedShape"). Fixed comments, and landed in r175172: <http://trac.webkit.org/r175172>.