The code generator speculation checks for SlowPutArrayStorageShape explicitly allows ArrayStorageShape arrays. The runtime slow paths that handles SlowPutArrayStorageShape is also capable of handling ArrayStorageShape arrays. As a result, the CFA may declare some basic blocks as unreachable though the code generator expects otherwise.
<rdar://problem/18604058>
<rdar://problem/19164372>
Created attachment 242687 [details] the patch Regression tests and benchmarks are in progress.
Will write a regression test for this soon: https://bugs.webkit.org/show_bug.cgi?id=139328
Comment on attachment 242687 [details] the patch Test? Otherwise LGTM.
Created attachment 242846 [details] patch 2 with test added.
Comment on attachment 242846 [details] patch 2 with test added. r=me
Thanks for the review. Landed in r176972: <http://trac.webkit.org/r176972>.
*** Bug 139328 has been marked as a duplicate of this bug. ***