Patch forthcoming.
Created attachment 280964 [details] the patch
Comment on attachment 280964 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=280964&action=review > Source/JavaScriptCore/dfg/DFGNode.h:546 > + void convertToPutByOffset(StorageAccessData& data, Edge storage, Edge childEdge) I'd call this base
(In reply to comment #2) > Comment on attachment 280964 [details] > the patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=280964&action=review > > > Source/JavaScriptCore/dfg/DFGNode.h:546 > > + void convertToPutByOffset(StorageAccessData& data, Edge storage, Edge childEdge) > > I'd call this base Fixed!
Landed in http://trac.webkit.org/changeset/201900