Changeset 156211 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

Timestamp:

Sep 20, 2013, 5:00:30 PM (12 years ago)

Author:

[email protected]

Message:

REGRESSION(r153215): New iCloud site crashes
​https://bugs.webkit.org/show_bug.cgi?id=121710

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Don't claim to be able to rely on the arguments structure, use the Arguments
speculation type

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::::executeEffects):

LayoutTests:

New test case

• js/dfg-arguments-mutated-structure-expected.txt: Added.
• js/dfg-arguments-mutated-structure.html: Added.
• js/script-tests/dfg-arguments-mutated-structure.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -1121 +1121 @@
         m_state.setHaveStructures(true);
         break;
-        
+    
     case CreateArguments:
-        forNode(node).set(
-            m_graph, m_codeBlock->globalObjectFor(node->codeOrigin)->argumentsStructure());
-        m_state.setHaveStructures(true);
+        forNode(node).setType(SpecArguments);
         break;