Bug 159501

Summary:

ToThis constant folding in DFG is incorrect when the structure indicates that toThis is overridden

Product:

WebKit

Reporter:

Saam Barati <saam>

Component:

JavaScriptCore

Assignee:

Saam Barati <saam>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, commit-queue, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, oliver, sukolsak, webkit-bug-importer, ysuzuki

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
patch	none

Description Saam Barati 2016-07-06 19:07:42 PDT

...

Comment 1 Saam Barati 2016-07-06 19:08:10 PDT

<rdar://problem/27109354>

Comment 2 Saam Barati 2016-07-07 13:59:56 PDT

Created attachment 283046 [details]
patch

Comment 3 Mark Lam 2016-07-07 14:02:35 PDT

Comment on attachment 283046 [details]
patch

r=me

Comment 4 WebKit Commit Bot 2016-07-07 15:15:42 PDT

Comment on attachment 283046 [details]
patch

Clearing flags on attachment: 283046

Committed r202936: <http://trac.webkit.org/changeset/202936>

Comment 5 WebKit Commit Bot 2016-07-07 15:15:47 PDT

All reviewed patches have been landed.  Closing bug.