Summary: | Assigning to a readonly global results in DFG byte code parse failure | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Oliver Hunt <oliver> | ||||
Component: | JavaScriptCore | Assignee: | Oliver Hunt <oliver> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | fpizlo, ggaren | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Attachments: |
|
Description
Oliver Hunt
2013-08-14 17:57:52 PDT
Created attachment 208838 [details]
Patch
Comment on attachment 208838 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review > Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178 > + // If we're writing to a readonly property we emit a Dynamic put that > + // the DFG can't currently handle. Really? Comment on attachment 208838 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review >> Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178 >> + // the DFG can't currently handle. > > Really? Oh, yeah, really. Committed r154120: <http://trac.webkit.org/changeset/154120> Comment on attachment 208838 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review > Source/JavaScriptCore/dfg/DFGCapabilities.cpp:186 > - ResolveType resolveType = static_cast<ResolveType>(pc[3].u.operand); > + ResolveType resolveType = ResolveModeAndType(pc[4].u.operand).type(); Why? It appears that the DFG bytecodeparser and the bytecompiler both put the type in 3, not 4. |