-
fpizlo@apple.com authored
Testing whether indexing type is ArrayWithArrayStorage should not compare against ArrayWithArrayStorage https://bugs.webkit.org/show_bug.cgi?id=96611 Reviewed by Gavin Barraclough. * dfg/DFGRepatch.cpp: (JSC::DFG::tryCacheGetByID): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): * jit/JITPropertyAccess.cpp: (JSC::JIT::privateCompilePatchGetArrayLength): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::privateCompilePatchGetArrayLength): * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128425 268f45cc-cd09-0410-ab3c-d52691b4dbfc
6f88333e