Changeset 91034 in webkit
- Timestamp:
- Jul 14, 2011 4:26:45 PM (13 years ago)
- Location:
- trunk
- Files:
-
- 3 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r91032 r91034 1 2011-07-14 Filip Pizlo <fpizlo@apple.com> 2 3 DFG JIT crashes on host constructor calls in debug mode. 4 https://bugs.webkit.org/show_bug.cgi?id=64562 5 6 Reviewed by Gavin Barraclough. 7 8 This bug snuck past our tests, so this patchs adds a test to cover this 9 case. 10 11 * fast/js/array-constructor-host-call-expected.txt: Added. 12 * fast/js/array-constructor-host-call.html: Added. 13 * fast/js/script-tests/array-constructor-host-call.js: Added. 14 (constructArray): 15 1 16 2011-07-14 Vincent Scheib <scheib@chromium.org> 2 17 -
trunk/Source/JavaScriptCore/ChangeLog
r91022 r91034 1 2011-07-14 Filip Pizlo <fpizlo@apple.com> 2 3 DFG JIT crashes on host constructor calls in debug mode. 4 https://bugs.webkit.org/show_bug.cgi?id=64562 5 6 Reviewed by Gavin Barraclough. 7 8 Fixed the relevant ASSERT. 9 10 * dfg/DFGOperations.cpp: 11 1 12 2011-07-14 Filip Pizlo <fpizlo@apple.com> 2 13 -
trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp
r90950 r91034 478 478 ConstructType constructType = getConstructData(callee, constructData); 479 479 480 ASSERT(constructType = ConstructTypeJS);480 ASSERT(constructType != ConstructTypeJS); 481 481 482 482 if (constructType == ConstructTypeHost) {
Note: See TracChangeset
for help on using the changeset viewer.