Changeset 92040 in webkit


Ignore:
Timestamp:
Jul 29, 2011 7:06:58 PM (13 years ago)
Author:
fpizlo@apple.com
Message:

LayoutTests does not have a test for array speculation pathologies in the JavaScriptCore DFG JIT.
​https://bugs.webkit.org/show_bug.cgi?id=65397

Reviewed by Darin Adler.

This test reproduces the crash seen in ​https://bugs.webkit.org/show_bug.cgi?id=65327, and is
designed to guard itself against possible variants of array speculation failure. It will
test both the case where a speculate-array value is actually a non-array object, and the
case where it is a number. Particular care is taken to increase the likelihood that the
test remains relevant if the JIT performs speculation based on actual argument types and
values at the time of compilation.

  • fast/js/array-type-speculation-expected.txt: Added.
  • fast/js/array-type-speculation.html: Added.
  • fast/js/script-tests/array-type-speculation.js: Added.
Location:
trunk/LayoutTests
Files:
3 added
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r92033 r92040  
     12011-07-29  Filip Pizlo  <fpizlo@apple.com>
     2
     3        LayoutTests does not have a test for array speculation pathologies in the JavaScriptCore DFG JIT.
     4        https://bugs.webkit.org/show_bug.cgi?id=65397
     5
     6        Reviewed by Darin Adler.
     7       
     8        This test reproduces the crash seen in https://bugs.webkit.org/show_bug.cgi?id=65327, and is
     9        designed to guard itself against possible variants of array speculation failure.  It will
     10        test both the case where a speculate-array value is actually a non-array object, and the
     11        case where it is a number.  Particular care is taken to increase the likelihood that the
     12        test remains relevant if the JIT performs speculation based on actual argument types and
     13        values at the time of compilation.
     14
     15        * fast/js/array-type-speculation-expected.txt: Added.
     16        * fast/js/array-type-speculation.html: Added.
     17        * fast/js/script-tests/array-type-speculation.js: Added.
     18
    1192011-07-29  Zhenyao Mo  <zmo@google.com>
    220
Note: See TracChangeset for help on using the changeset viewer.