Bug 119913

Summary:

Baseline JIT gives erroneous error message that an object is not a constructor though it expects a function

Product:

WebKit

Reporter:

Mark Lam <mark.lam>

Component:

JavaScriptCore

Assignee:

Mark Lam <mark.lam>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

chris_curtis, fpizlo, ggaren, mhahnenberg, msaboff, oliver

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
the patch.	msaboff: review+

Mark Lam

Reported 2013-08-16 14:14:43 PDT

Some layout test fails with text diffs because the baseline JIT is throwing errors with the wrong message: Expected message: "… is not a function …" Actual message: "… is not a constructor …" These failures shows up if I do a test run on a build with the LLINT disabled to force the baseline JIT to be used. The failing tests are: fast/js/exception-thrown-from-new.html fast/regex/cross-frame-callable.html http/tests/security/document-all.html http/tests/security/xss-DENIED-window-index-assign.html inspector/console/console-exception-stack-traces.html plugins/npruntime/object-from-destroyed-plugin-in-subframe.html plugins/npruntime/object-from-destroyed-plugin.html plugins/npruntime/plugin-scriptable-object-invoke-default.html sputnik/Conformance/13_Function_Definition/S13_A17_T2.html sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/S15.1_A2_T1.html sputnik/Conformance/15_Native_Objects/15.2_Object/15.2.4/S15.2.4_A3.html Patch for fix coming soon.

Attachments
the patch. (1.49 KB, patch) 2013-08-16 14:24 PDT, Mark Lam	msaboff: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Mark Lam

Comment 1 2013-08-16 14:24:24 PDT

Created attachment 208959 [details] the patch.

Mark Lam

Comment 2 2013-08-16 14:40:37 PDT

Thanks for the review. Landed in r154204: <http://trac.webkit.org/r154204>.

Note You need to log in before you can comment on or make changes to this bug.