Title: [237526] branches/safari-606-branch/JSTests
- Revision
- 237526
- Author
- [email protected]
- Date
- 2018-10-28 12:12:22 -0700 (Sun, 28 Oct 2018)
Log Message
Cherry-pick r237326. rdar://problem/45363533
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
Rubber-stamped by Saam Barati.
Adding another test.
* stress/regress-190515-2.js: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@237326 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-606-branch/JSTests/ChangeLog (237525 => 237526)
--- branches/safari-606-branch/JSTests/ChangeLog 2018-10-28 19:12:20 UTC (rev 237525)
+++ branches/safari-606-branch/JSTests/ChangeLog 2018-10-28 19:12:22 UTC (rev 237526)
@@ -1,5 +1,35 @@
2018-10-28 Babak Shafiei <[email protected]>
+ Cherry-pick r237326. rdar://problem/45363533
+
+ DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
+ https://bugs.webkit.org/show_bug.cgi?id=190515
+ <rdar://problem/45222379>
+
+ Rubber-stamped by Saam Barati.
+
+ Adding another test.
+
+ * stress/regress-190515-2.js: Added.
+
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@237326 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2018-10-22 Mark Lam <[email protected]>
+
+ DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
+ https://bugs.webkit.org/show_bug.cgi?id=190515
+ <rdar://problem/45222379>
+
+ Rubber-stamped by Saam Barati.
+
+ Adding another test.
+
+ * stress/regress-190515-2.js: Added.
+
+2018-10-28 Babak Shafiei <[email protected]>
+
Cherry-pick r237325. rdar://problem/45363533
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
Added: branches/safari-606-branch/JSTests/stress/regress-190515-2.js (0 => 237526)
--- branches/safari-606-branch/JSTests/stress/regress-190515-2.js (rev 0)
+++ branches/safari-606-branch/JSTests/stress/regress-190515-2.js 2018-10-28 19:12:22 UTC (rev 237526)
@@ -0,0 +1,15 @@
+//@ requireOptions("--jitPolicyScale=0")
+
+// This test should not crash.
+
+function test(array) {
+ return array.push(0, 0.1);
+}
+
+for (var i = 0; i < 100000; ++i) {
+ test([])
+}
+
+for (var i = 0; i < 100000; ++i) {
+ test([0])
+}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
