....
Created attachment 288544 [details] WIP I think this is the patch. Lets see what EWS thinks.
Created attachment 288552 [details] patch
Created attachment 288554 [details] patch
Comment on attachment 288554 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=288554&action=review > Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:987 > + // We don't want this JSValue to devolve into a double so > + // we cast it to an int32_t. When we actually use this > + // value, we will use it as if it were unsigned. > + setConstant(node, JSValue(static_cast<int32_t>(*hash))); Does MapHash ordinarily return an int32? If so, then this comment would be less confusing as: "Although C++ code uses uint32_t for the hash, the closest type in DFG IR is Int32 and that's what MapHash returns. So, we have to cast to int32_t to avoid large unsigned values becoming doubles." Also, I would use jsNumber(int32_t) instead of JSValue().
Created attachment 288594 [details] patch for landing
Comment on attachment 288594 [details] patch for landing Clearing flags on attachment: 288594 Committed r205819: <http://trac.webkit.org/changeset/205819>
All reviewed patches have been landed. Closing bug.