The JavaScriptCore DFG JIT may speculate that a value is an array. The code is relatively tricky, since a distinction is made between speculating that a variable is an array throughout the entire procedure, versus speculating that a variable happens to reference an array during the course of a particular array access. The latter code path has not been exercised in existing tests, so a new test is needed.
Created attachment 102404 [details] the patch
Comment on attachment 102404 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=102404&action=review > LayoutTests/fast/js/array-type-speculation-expected.txt:6 > +PASS result is "foo" When possible, it's better to construct the test so that you can see what is being tested in the test output. Just seeing "result" is not so great. One way to do that is to make sure that the argument to shouldBe itself contains arguments that make it clear which test is which. But I know that with JavaScript testing it can be tricky to achieve that since different ways of executing code exercise different code paths.
Comment on attachment 102404 [details] the patch Clearing flags on attachment: 102404 Committed r92040: <http://trac.webkit.org/changeset/92040>
All reviewed patches have been landed. Closing bug.