<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>119830</bug_id>
          
          <creation_ts>2013-08-14 17:57:52 -0700</creation_ts>
          <short_desc>Assigning to a readonly global results in DFG byte code parse failure</short_desc>
          <delta_ts>2013-08-15 14:51:34 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Oliver Hunt">oliver</reporter>
          <assigned_to name="Oliver Hunt">oliver</assigned_to>
          <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>917376</commentid>
    <comment_count>0</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-08-14 17:57:52 -0700</bug_when>
    <thetext>JSC fails to compile

for (;;) { try { eval(&quot;NaN = 0&quot;); } catch(e) {} }

Due to a parse failure of Dynamic put</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>917643</commentid>
    <comment_count>1</comment_count>
      <attachid>208838</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-08-15 12:39:00 -0700</bug_when>
    <thetext>Created attachment 208838
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>917645</commentid>
    <comment_count>2</comment_count>
      <attachid>208838</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-08-15 12:41:07 -0700</bug_when>
    <thetext>Comment on attachment 208838
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208838&amp;action=review

&gt; Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178
&gt; +        // If we&apos;re writing to a readonly property we emit a Dynamic put that
&gt; +        // the DFG can&apos;t currently handle.

Really?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>917646</commentid>
    <comment_count>3</comment_count>
      <attachid>208838</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-08-15 12:41:43 -0700</bug_when>
    <thetext>Comment on attachment 208838
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208838&amp;action=review

&gt;&gt; Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178
&gt;&gt; +        // the DFG can&apos;t currently handle.
&gt; 
&gt; Really?

Oh, yeah, really.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>917648</commentid>
    <comment_count>4</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-08-15 12:43:11 -0700</bug_when>
    <thetext>Committed r154120: &lt;http://trac.webkit.org/changeset/154120&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>917719</commentid>
    <comment_count>5</comment_count>
      <attachid>208838</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-08-15 14:51:34 -0700</bug_when>
    <thetext>Comment on attachment 208838
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208838&amp;action=review

&gt; Source/JavaScriptCore/dfg/DFGCapabilities.cpp:186
&gt; -        ResolveType resolveType = static_cast&lt;ResolveType&gt;(pc[3].u.operand);
&gt; +        ResolveType resolveType = ResolveModeAndType(pc[4].u.operand).type();

Why?  It appears that the DFG bytecodeparser and the bytecompiler both put the type in 3, not 4.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>208838</attachid>
            <date>2013-08-15 12:39:00 -0700</date>
            <delta_ts>2013-08-15 14:51:34 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-119830-20130815124151.patch</filename>
            <type>text/plain</type>
            <size>5590</size>
            <attacher name="Oliver Hunt">oliver</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTU0MTE0CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBm
N2U4ZGE2YjY0MTIxMTc1ODhmN2E2MjYzZmQ0NmUyYjI2ZjlkNWI0Li4yZTFiYjNiMjczYTVhMzkx
MDdhYjc0YzdhMzE2NzdkZjY0NjBjNjg2IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxNyBAQAorMjAxMy0wOC0xNSAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgor
CisgICAgICAgIDxodHRwczovL3dlYmtpdC5vcmcvYi8xMTk4MzA+IEFzc2lnbmluZyB0byBhIHJl
YWRvbmx5IGdsb2JhbCByZXN1bHRzIGluIERGRyBieXRlIGNvZGUgcGFyc2UgZmFpbHVyZQorCisg
ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE1ha2Ugc3VyZSBk
ZmdDYXBhYmlsaXRpZXMgZG9lc24ndCByZXBvcnQgYSBEeW5hbWljIHB1dCBhcworICAgICAgICBi
ZWluZyBjb21waWxhYmxlIHdoZW4gd2UgZG9uJ3QgYWN0dWFsbHkgc3VwcG9ydCBpdC4gIAorCisg
ICAgICAgICogYnl0ZWNvZGUvQ29kZUJsb2NrLmNwcDoKKyAgICAgICAgKEpTQzo6Q29kZUJsb2Nr
OjpkdW1wQnl0ZWNvZGUpOgorICAgICAgICAqIGRmZy9ERkdDYXBhYmlsaXRpZXMuY3BwOgorICAg
ICAgICAoSlNDOjpERkc6OmNhcGFiaWxpdHlMZXZlbCk6CisKIDIwMTMtMDgtMTUgIEdhdmluIEJh
cnJhY2xvdWdoICA8YmFycmFjbG91Z2hAYXBwbGUuY29tPgogCiAgICAgICAgIGh0dHBzOi8vYnVn
cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTk4NDMKZGlmZiAtLWdpdCBhL1NvdXJjZS9K
YXZhU2NyaXB0Q29yZS9ieXRlY29kZS9Db2RlQmxvY2suY3BwIGIvU291cmNlL0phdmFTY3JpcHRD
b3JlL2J5dGVjb2RlL0NvZGVCbG9jay5jcHAKaW5kZXggNGU3MDIyYWNkOWRjOWNmNjlkMDRjMzg4
MmNjMTQ1ZjYwNmRkNzA5Mi4uNWVhNmZhMzM0ZmUwZmZjMzk4ZWI3YzBkYzcxOTQ4MjNiNTk3YTg0
ZCAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL0NvZGVCbG9jay5j
cHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL0NvZGVCbG9jay5jcHAKQEAg
LTEyOTEsOSArMTI5MSw5IEBAIHZvaWQgQ29kZUJsb2NrOjpkdW1wQnl0ZWNvZGUoUHJpbnRTdHJl
YW0mIG91dCwgRXhlY1N0YXRlKiBleGVjLCBjb25zdCBJbnN0cnVjdGlvCiAgICAgICAgIGNhc2Ug
b3BfcmVzb2x2ZV9zY29wZTogewogICAgICAgICAgICAgaW50IHIwID0gKCsraXQpLT51Lm9wZXJh
bmQ7CiAgICAgICAgICAgICBpbnQgaWQwID0gKCsraXQpLT51Lm9wZXJhbmQ7Ci0gICAgICAgICAg
ICArK2l0OyAvLyBSZXNvbHZlVHlwZQorICAgICAgICAgICAgaW50IHJlc29sdmVNb2RlQW5kVHlw
ZSA9ICgrK2l0KS0+dS5vcGVyYW5kOwogICAgICAgICAgICAgKytpdDsgLy8gZGVwdGgKLSAgICAg
ICAgICAgIG91dC5wcmludGYoIlslNGRdIHJlc29sdmVfc2NvcGVcdCAlcywgJXMiLCBsb2NhdGlv
biwgcmVnaXN0ZXJOYW1lKHIwKS5kYXRhKCksIGlkTmFtZShpZDAsIGlkZW50aWZpZXIoaWQwKSku
ZGF0YSgpKTsKKyAgICAgICAgICAgIG91dC5wcmludGYoIlslNGRdIHJlc29sdmVfc2NvcGVcdCAl
cywgJXMsICVkIiwgbG9jYXRpb24sIHJlZ2lzdGVyTmFtZShyMCkuZGF0YSgpLCBpZE5hbWUoaWQw
LCBpZGVudGlmaWVyKGlkMCkpLmRhdGEoKSwgcmVzb2x2ZU1vZGVBbmRUeXBlKTsKICAgICAgICAg
ICAgIGJyZWFrOwogICAgICAgICB9CiAgICAgICAgIGNhc2Ugb3BfZ2V0X2Zyb21fc2NvcGU6IHsK
ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ2FwYWJpbGl0aWVzLmNw
cCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ2FwYWJpbGl0aWVzLmNwcAppbmRleCBh
Yjk4YzY5MzdlYWE2MWE1Yjg5ZDQ4MWI4Y2IwNjRkYWI0ZjljMmE5Li44MmVlNDdiNzYxNDBmMDgw
MjNjYTdmYmEzNmFjODBhYmRhMTFmN2M5IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvZGZnL0RGR0NhcGFiaWxpdGllcy5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm
Zy9ERkdDYXBhYmlsaXRpZXMuY3BwCkBAIC0xNzAsMTIgKzE3MCwyMCBAQCBDYXBhYmlsaXR5TGV2
ZWwgY2FwYWJpbGl0eUxldmVsKE9wY29kZUlEIG9wY29kZUlELCBDb2RlQmxvY2sqIGNvZGVCbG9j
aywgSW5zdHJ1YwogICAgIGNhc2Ugb3Bfc3dpdGNoX2NoYXI6CiAgICAgY2FzZSBvcF9pbjoKICAg
ICBjYXNlIG9wX2dldF9mcm9tX3Njb3BlOgotICAgIGNhc2Ugb3BfcHV0X3RvX3Njb3BlOgogICAg
ICAgICByZXR1cm4gQ2FuQ29tcGlsZUFuZElubGluZTsKIAorICAgIGNhc2Ugb3BfcHV0X3RvX3Nj
b3BlOiB7CisgICAgICAgIFJlc29sdmVUeXBlIHJlc29sdmVUeXBlID0gUmVzb2x2ZU1vZGVBbmRU
eXBlKHBjWzRdLnUub3BlcmFuZCkudHlwZSgpOworICAgICAgICAvLyBJZiB3ZSdyZSB3cml0aW5n
IHRvIGEgcmVhZG9ubHkgcHJvcGVydHkgd2UgZW1pdCBhIER5bmFtaWMgcHV0IHRoYXQKKyAgICAg
ICAgLy8gdGhlIERGRyBjYW4ndCBjdXJyZW50bHkgaGFuZGxlLgorICAgICAgICBpZiAocmVzb2x2
ZVR5cGUgPT0gRHluYW1pYykKKyAgICAgICAgICAgIHJldHVybiBDYW5ub3RDb21waWxlOworICAg
ICAgICByZXR1cm4gQ2FuQ29tcGlsZUFuZElubGluZTsKKyAgICB9CisKICAgICBjYXNlIG9wX3Jl
c29sdmVfc2NvcGU6IHsKICAgICAgICAgLy8gV2UgZG9uJ3QgY29tcGlsZSAnY2F0Y2gnIG9yICd3
aXRoJywgc28gdGhlcmUncyBubyBwb2ludCBpbiBjb21waWxpbmcgdmFyaWFibGUgcmVzb2x1dGlv
biB3aXRoaW4gdGhlbS4KLSAgICAgICAgUmVzb2x2ZVR5cGUgcmVzb2x2ZVR5cGUgPSBzdGF0aWNf
Y2FzdDxSZXNvbHZlVHlwZT4ocGNbM10udS5vcGVyYW5kKTsKKyAgICAgICAgUmVzb2x2ZVR5cGUg
cmVzb2x2ZVR5cGUgPSBSZXNvbHZlTW9kZUFuZFR5cGUocGNbNF0udS5vcGVyYW5kKS50eXBlKCk7
CiAgICAgICAgIGlmIChyZXNvbHZlVHlwZSA9PSBEeW5hbWljKQogICAgICAgICAgICAgcmV0dXJu
IENhbm5vdENvbXBpbGU7CiAgICAgICAgIHJldHVybiBDYW5Db21waWxlQW5kSW5saW5lOwpkaWZm
IC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmlu
ZGV4IDUzNmM1ZGM3MDBlN2I4YzU2MGM4ZmMwZTBkMzA0OGZlOTcxMWVmNTYuLmMzMTk0NGUyMThi
M2FjNzc5MDlhZjRjYWY1MjRlODhmOWVkZGE2NWUgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0No
YW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNyBAQAorMjAx
My0wOC0xNSAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgorCisgICAgICAgIDxodHRw
czovL3dlYmtpdC5vcmcvYi8xMTk4MzA+IEFzc2lnbmluZyB0byBhIHJlYWRvbmx5IGdsb2JhbCBy
ZXN1bHRzIGluIERGRyBieXRlIGNvZGUgcGFyc2UgZmFpbHVyZQorCisgICAgICAgIFJldmlld2Vk
IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCBhIHRlc3QKKworICAgICAgICAqIGZh
c3QvanMvZGZnLXB1dC10by1yZWFkb25seS1wcm9wZXJ0eS1leHBlY3RlZC50eHQ6IEFkZGVkLgor
ICAgICAgICAqIGZhc3QvanMvZGZnLXB1dC10by1yZWFkb25seS1wcm9wZXJ0eS5odG1sOiBBZGRl
ZC4KKyAgICAgICAgKiBmYXN0L2pzL3NjcmlwdC10ZXN0cy9kZmctcHV0LXRvLXJlYWRvbmx5LXBy
b3BlcnR5LmpzOiBBZGRlZC4KKyAgICAgICAgKGZvbyk6CisgICAgICAgIChiYXIpOgorCiAyMDEz
LTA4LTE1ICBNYXJpbyBTYW5jaGV6IFByYWRhICA8bWFyaW8ucHJhZGFAc2Ftc3VuZy5jb20+CiAK
ICAgICAgICAgW0dUS10gVW5yZXZpZXdlZCBnYXJkZW5pbmcuIE1vdmUgTWFjIHNwZWNpZmljIGV4
cGVjdGF0aW9uIGZvcgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9qcy9kZmctcHV0LXRv
LXJlYWRvbmx5LXByb3BlcnR5LWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvanMvZGZn
LXB1dC10by1yZWFkb25seS1wcm9wZXJ0eS1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2
NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNDNlNWVl
ZWRiZjFiNDM1Zjk2YzNhMjBiZjgxNDAxYWVlNDMzMTk4MQotLS0gL2Rldi9udWxsCisrKyBiL0xh
eW91dFRlc3RzL2Zhc3QvanMvZGZnLXB1dC10by1yZWFkb25seS1wcm9wZXJ0eS1leHBlY3RlZC50
eHQKQEAgLTAsMCArMSw0IEBACitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCisKK1RF
U1QgQ09NUExFVEUKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9qcy9kZmctcHV0LXRv
LXJlYWRvbmx5LXByb3BlcnR5Lmh0bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL2RmZy1wdXQtdG8t
cmVhZG9ubHktcHJvcGVydHkuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5lMzJjNmFkZjZjZmE3YTFjNmU4YjA4
OWY0MTBlM2YzNDRhNTM5YTY1Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9q
cy9kZmctcHV0LXRvLXJlYWRvbmx5LXByb3BlcnR5Lmh0bWwKQEAgLTAsMCArMSwxMCBAQAorPCFE
T0NUWVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9EVEQgSFRNTC8vRU4iPgorPGh0bWw+Cis8aGVh
ZD4KKzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9o
ZWFkPgorPGJvZHk+Cis8c2NyaXB0IHNyYz0ic2NyaXB0LXRlc3RzL2RmZy1wdXQtdG8tcmVhZG9u
bHktcHJvcGVydHkuanMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9qcy10ZXN0
LXBvc3QuanMiPjwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgpkaWZmIC0tZ2l0IGEvTGF5b3V0
VGVzdHMvZmFzdC9qcy9zY3JpcHQtdGVzdHMvZGZnLXB1dC10by1yZWFkb25seS1wcm9wZXJ0eS5q
cyBiL0xheW91dFRlc3RzL2Zhc3QvanMvc2NyaXB0LXRlc3RzL2RmZy1wdXQtdG8tcmVhZG9ubHkt
cHJvcGVydHkuanMKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uYmIyYzE4Y2ZjNjliNTljZDA1NjQ3NTIwN2JlYTYxYjdl
OTRlNDU4ZAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvanMvc2NyaXB0LXRl
c3RzL2RmZy1wdXQtdG8tcmVhZG9ubHktcHJvcGVydHkuanMKQEAgLTAsMCArMSwxOSBAQAorZnVu
Y3Rpb24gZm9vKGEpIHsKKyAgICBOYU49MAorICAgIHJldHVybiBOYU58MDsKK30KKworZnVuY3Rp
b24gYmFyKGEpIHsKKyAgICByZXR1cm4gZm9vKGEpIHwgZXZhbCgiTmFOPTAiKTsKK30KKworbm9J
bmxpbmUoYmFyKTsKKwordmFyIHN1bSA9IDA7Cit2YXIgaSA9IDA7Cit3aGlsZSAoaSA8IDEwMDAw
KSB7CisgICAgc3VtICs9IGJhcihpKTsKKyAgICBpKys7Cit9CisKK3N1bSArPSBiYXIoaSwgdHJ1
ZSk7Cg==
</data>
<flag name="review"
          id="230790"
          type_id="1"
          status="+"
          setter="fpizlo"
    />
          </attachment>
      

    </bug>

</bugzilla>