...
Created attachment 442666 [details] Patch
Comment on attachment 442666 [details] Patch r=me I also found several other places `structure->type() == JSType::ArrayType` in DFGOperations.cpp. Can you fix it too?
Created attachment 442668 [details] patch for landing
Created attachment 442713 [details] patch for landing
Committed r285004 (243650@main): <https://commits.webkit.org/243650@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 442713 [details].
<rdar://problem/84778008>