Changeset 92040 in webkit
- Timestamp:
- Jul 29, 2011 7:06:58 PM (13 years ago)
- Location:
- trunk/LayoutTests
- Files:
-
- 3 added
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r92033 r92040 1 2011-07-29 Filip Pizlo <fpizlo@apple.com> 2 3 LayoutTests does not have a test for array speculation pathologies in the JavaScriptCore DFG JIT. 4 https://bugs.webkit.org/show_bug.cgi?id=65397 5 6 Reviewed by Darin Adler. 7 8 This test reproduces the crash seen in https://bugs.webkit.org/show_bug.cgi?id=65327, and is 9 designed to guard itself against possible variants of array speculation failure. It will 10 test both the case where a speculate-array value is actually a non-array object, and the 11 case where it is a number. Particular care is taken to increase the likelihood that the 12 test remains relevant if the JIT performs speculation based on actual argument types and 13 values at the time of compilation. 14 15 * fast/js/array-type-speculation-expected.txt: Added. 16 * fast/js/array-type-speculation.html: Added. 17 * fast/js/script-tests/array-type-speculation.js: Added. 18 1 19 2011-07-29 Zhenyao Mo <zmo@google.com> 2 20
Note: See TracChangeset
for help on using the changeset viewer.