Patch forthcoming.
Created attachment 259730 [details] the patch
Comment on attachment 259730 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=259730&action=review r=me > Source/JavaScriptCore/ChangeLog:19 > + It seems like it would be best to just lift this restrictions. restriction
Comment on attachment 259730 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=259730&action=review r=me > Source/JavaScriptCore/dfg/DFGInsertionSet.cpp:35 > + for (size_t index = m_insertions.size() - 1; index--;) { Even though this is checked at the call site for this function, it might be nice for documentation's sake to assert that the last element's index is larger than what we're inserting.
(In reply to comment #2) > Comment on attachment 259730 [details] > the patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=259730&action=review > > r=me > > > Source/JavaScriptCore/ChangeLog:19 > > + It seems like it would be best to just lift this restrictions. > > restriction Fixed.
(In reply to comment #3) > Comment on attachment 259730 [details] > the patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=259730&action=review > > r=me > > > Source/JavaScriptCore/dfg/DFGInsertionSet.cpp:35 > > + for (size_t index = m_insertions.size() - 1; index--;) { > > Even though this is checked at the call site for this function, it might be > nice for documentation's sake to assert that the last element's index is > larger than what we're inserting. Done.
Landed in http://trac.webkit.org/changeset/188879