It is often used in places where we can't assume that the previous ByVal op had done a proper array bounds check.
<rdar://problem/11751830>
Created attachment 149631 [details] the patch
Comment on attachment 149631 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=149631&action=review If possible please to be adding a test for the regular arrays. > Source/JavaScriptCore/dfg/DFGGraph.h:480 > + return true; :-(
Landed in http://trac.webkit.org/changeset/121307