Bug 201853 – CheckArray on DirectArguments/ScopedArguments does not filter out slow put array storage

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

...

[Saam Barati]

<rdar://problem/53805461>

[Saam Barati]

Created attachment 378924 [details]
patch

[Yusuke Suzuki]

Comment on attachment 378924 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=378924&action=review

r=me with comment.

> Source/JavaScriptCore/dfg/DFGArrayMode.h:447
> +            return arrayModesWithIndexingShapes(ArrayStorageShape, NonArray) | arrayModesWithIndexingShapes(SlowPutArrayStorageShape, NonArray);

Should we just do like, `arrayModesWithIndexingShapes(NonArray, ArrayStorageShape, SlowPutArrayStorageShape)`?

[Saam Barati]

Comment on attachment 378924 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=378924&action=review

>> Source/JavaScriptCore/dfg/DFGArrayMode.h:447
>> +            return arrayModesWithIndexingShapes(ArrayStorageShape, NonArray) | arrayModesWithIndexingShapes(SlowPutArrayStorageShape, NonArray);
> 
> Should we just do like, `arrayModesWithIndexingShapes(NonArray, ArrayStorageShape, SlowPutArrayStorageShape)`?

yes, I meant to do that :)

[Saam Barati]

Created attachment 378925 [details]
patch for landing

[WebKit Commit Bot]

Comment on attachment 378925 [details]
patch for landing

Clearing flags on attachment: 378925

Committed r249959: <https://trac.webkit.org/changeset/249959>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.