Changeset 145417 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Mar 11, 2013, 3:36:28 PM (12 years ago)

Author:

[email protected]

Message:

Crash beneath operationCreateInlinedArguments running fast/js/dfg-create-inlined-arguments-in-closure-inline.html (32-bit only)
​https://bugs.webkit.org/show_bug.cgi?id=112067

Reviewed by Geoffrey Garen.

We weren't setting the tag in SetCallee. Therefore set it to CellTag.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-03-11  Michael Saboff  <[email protected]>
+
+        Crash beneath operationCreateInlinedArguments running fast/js/dfg-create-inlined-arguments-in-closure-inline.html (32-bit only)
+        https://bugs.webkit.org/show_bug.cgi?id=112067
+
+        Reviewed by Geoffrey Garen.
+
+        We weren't setting the tag in SetCallee.  Therefore set it to CellTag.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2013-03-11  Oliver Hunt  <[email protected]>