DFG should not speculate array even when predictions say that the base is not an...
[WebKit-https.git] / Source / JavaScriptCore / dfg / DFGPropagator.cpp
index 1804c95e0e27079ba48f87b4afa2bbbb635c475c..392fad38bde15835b5ef45ef0c3049089e934b76 100644 (file)
@@ -1087,8 +1087,10 @@ private:
     
     bool byValIsPure(Node& node)
     {
-        PredictedType prediction = m_graph[node.child2()].prediction();
-        return (prediction & PredictInt32) || !prediction;
+        return m_graph[node.child2()].shouldSpeculateInteger()
+            && ((node.op == PutByVal || node.op == PutByValAlias)
+                ? isActionableMutableArrayPrediction(m_graph[node.child1()].prediction())
+                : isActionableArrayPrediction(m_graph[node.child1()].prediction()));
     }
     
     bool clobbersWorld(NodeIndex nodeIndex)