[JSC] op_has_indexed_property should not assume subscript part is Uint32
Created attachment 367284 [details] Patch
<rdar://problem/49726277>
Created attachment 367286 [details] Patch
Comment on attachment 367286 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=367286&action=review > Source/JavaScriptCore/jit/JITOperations.cpp:2070 > + ASSERT(subscript.asAnyInt() <= UINT32_MAX); Maybe it’s worth a helper function since this is the second time you’re adding this code > Source/JavaScriptCore/jit/JITOperations.cpp:2074 > + uint32_t index = static_cast<uint32_t>(subscript.asAnyInt()); Ditto
Comment on attachment 367286 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=367286&action=review >> Source/JavaScriptCore/jit/JITOperations.cpp:2070 >> + ASSERT(subscript.asAnyInt() <= UINT32_MAX); > > Maybe it’s worth a helper function since this is the second time you’re adding this code Sounds nice! Like, asUint32AsAnyInt() / isUInt32AsAnyInt().
Committed r244211: <https://trac.webkit.org/changeset/244211>