Bug 127943

Summary:

REGRESSION (r160628): LLint does not appear to handle impure get own property properly

Product:

WebKit

Reporter:

Oliver Hunt <oliver>

Component:

JavaScriptCore

Assignee:

Ryosuke Niwa <rniwa>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, fpizlo, rniwa, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	fpizlo: review+

Description Oliver Hunt 2014-01-30 13:10:17 PST

If i have i disable the hits, then these tests fail:

[121/318] js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html failed unexpectedly (text diff)
[241/318] js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html failed unexpectedly (text diff)


Which appears to be due to incorrect document lookup caching

Comment 1 Radar WebKit Bug Importer 2014-01-30 13:30:25 PST

<rdar://problem/15950313>

Comment 2 Oliver Hunt 2014-02-07 11:53:17 PST

Created attachment 223478 [details]
Patch

Comment 3 Ryosuke Niwa 2014-02-07 11:54:47 PST

Comment on attachment 223478 [details]
Patch

Thanks for the fix!

Comment 4 Oliver Hunt 2014-02-07 11:55:24 PST

Committed r163639: <http://trac.webkit.org/changeset/163639>