diff options
| author | Oliver Hunt <oliver@apple.com> | 2014-09-24 18:46:55 +0200 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@digia.com> | 2014-09-25 11:38:07 +0200 |
| commit | fffb502f202586d7029385595a84142937499bd6 (patch) | |
| tree | dd524af615b24d0d44d2016794519805959aec6d /Source/JavaScriptCore/runtime/JSArray.cpp | |
| parent | f69ddfaa6d06e0c209365835ad7590e9c18f5103 (diff) | |
| download | qtwebkit-fffb502f202586d7029385595a84142937499bd6.tar.gz | |
REGRESSION: Crash when opening Facebook.com
https://bugs.webkit.org/show_bug.cgi?id=119155
Reviewed by Andreas Kling.
Scope nodes are always objects, so we should be using SpecObjectOther
rather than SpecCellOther. Marking Scopes as CellOther leads to a
contradiction in the CFA, resulting in bogus codegen.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
Change-Id: Ic083c04b9351c904ea4b5ee41bcc98c7d66d757d
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153410 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/runtime/JSArray.cpp')
0 files changed, 0 insertions, 0 deletions