Bug 121330

Summary:

DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam, vicki

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review+

Filip Pizlo

Reported 2013-09-13 16:10:32 PDT

Patch forthcoming.

Attachments
the patch (11.66 KB, patch) 2013-09-13 16:12 PDT, Filip Pizlo	oliver: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2013-09-13 16:12:25 PDT

Created attachment 211599 [details] the patch

Filip Pizlo

Comment 2 2013-09-13 16:17:41 PDT

Landed in http://trac.webkit.org/changeset/155730

Mark Lam

Comment 3 2013-09-19 12:25:04 PDT

*** Bug 121193 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.