Changeset 76049 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Jan 18, 2011, 1:09:29 PM (15 years ago)

Author:

[email protected]

Message:

2011-01-18 Oliver Hunt <​[email protected]>

Reviewed by Antti Koivisto.

[jsfunfuzz] Assertion in codegen for array of NaN constants
​https://bugs.webkit.org/show_bug.cgi?id=52643

Add a testcase to ensure we handle a large number of NaN literals
in (0/0 is folded to NaN automatically during parsing).

• fast/js/codegen-temporaries-expected.txt:
• fast/js/script-tests/codegen-temporaries.js:

2011-01-18 Oliver Hunt <​[email protected]>

Reviewed by Antti Koivisto.

[jsfunfuzz] Assertion in codegen for array of NaN constants
​https://bugs.webkit.org/show_bug.cgi?id=52643

Don't cache NaN literals in the code generator, as NaN doesn't compare
as equal to itself it causes problems when rehashing the number cache.

• bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitLoad):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-01-18  Oliver Hunt  <[email protected]>
+
+        Reviewed by Antti Koivisto.
+
+        [jsfunfuzz] Assertion in codegen for array of NaN constants
+        https://bugs.webkit.org/show_bug.cgi?id=52643
+
+        Don't cache NaN literals in the code generator, as NaN doesn't compare
+        as equal to itself it causes problems when rehashing the number cache.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+
 2011-01-17  Jarred Nicholls  <[email protected]>