Summary: | REGRESSION(r200117): Crash in lowerDFGToB3::compileStringReplace() | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Michael Saboff <msaboff> | ||||
Component: | JavaScriptCore | Assignee: | Michael Saboff <msaboff> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | commit-queue, keith_miller, mark.lam, saam, webkit-bug-importer | ||||
Priority: | P2 | Keywords: | InRadar | ||||
Version: | WebKit Nightly Build | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Attachments: |
|
Description
Michael Saboff
2016-04-27 12:53:56 PDT
Created attachment 277529 [details]
Patch
Comment on attachment 277529 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=277529&action=review > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6942 > + // The Edge for Child2 may have been fixed up as StringUse. not sure this comment adds much (In reply to comment #3) > Comment on attachment 277529 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=277529&action=review > > > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6942 > > + // The Edge for Child2 may have been fixed up as StringUse. > > not sure this comment adds much Removed locally. r=me too. Fixes my crash. Committed r200147: <http://trac.webkit.org/changeset/200147> |