REGRESSION(r154218): DFG::FixupPhase no longer turns GetById's child1 into CellUse
[WebKit-https.git] / Source / JavaScriptCore / dfg / DFGFixupPhase.cpp
index 5e07318..0c20704 100644 (file)
@@ -737,6 +737,7 @@ private:
                 attemptToMakeGetByteLength(node);
                 break;
             }
+            setUseKindAndUnboxIfProfitable<CellUse>(node->child1());
             break;
         }