Title: [237326] trunk/JSTests
- Revision
- 237326
- Author
- [email protected]
- Date
- 2018-10-22 12:07:37 -0700 (Mon, 22 Oct 2018)
Log Message
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
Rubber-stamped by Saam Barati.
Adding another test.
* stress/regress-190515-2.js: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (237325 => 237326)
--- trunk/JSTests/ChangeLog 2018-10-22 17:18:13 UTC (rev 237325)
+++ trunk/JSTests/ChangeLog 2018-10-22 19:07:37 UTC (rev 237326)
@@ -4,6 +4,18 @@
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
+ Rubber-stamped by Saam Barati.
+
+ Adding another test.
+
+ * stress/regress-190515-2.js: Added.
+
+2018-10-22 Mark Lam <[email protected]>
+
+ DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
+ https://bugs.webkit.org/show_bug.cgi?id=190515
+ <rdar://problem/45222379>
+
Reviewed by Saam Barati.
* stress/regress-190515.js: Added.
Added: trunk/JSTests/stress/regress-190515-2.js (0 => 237326)
--- trunk/JSTests/stress/regress-190515-2.js (rev 0)
+++ trunk/JSTests/stress/regress-190515-2.js 2018-10-22 19:07:37 UTC (rev 237326)
@@ -0,0 +1,15 @@
+//@ requireOptions("--jitPolicyScale=0")
+
+// This test should not crash.
+
+function test(array) {
+ return array.push(0, 0.1);
+}
+
+for (var i = 0; i < 100000; ++i) {
+ test([])
+}
+
+for (var i = 0; i < 100000; ++i) {
+ test([0])
+}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
