Sometimes, the DFG uses a GetById for typed array length accesses despite profiling data that indicates that it's a typed array length access
https://bugs.webkit.org/show_bug.cgi?id=119874
Reviewed by Oliver Hunt and Mark Hahnenberg.
It was a confusion between heuristics in DFG::ArrayMode that are assuming that
you'll use ForceExit if array profiles are empty, the JIT creating empty profiles
sometimes for typed array length accesses, and the FixupPhase assuming that a
ForceExit ArrayMode means that it should continue using a generic GetById.
This fixes the confusion.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154157 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2 files changed
