Bug 84898

Summary:

Biolab disaster crashes on ToT

Product:

WebKit

Reporter:

Oliver Hunt <oliver>

Component:

New Bugs

Assignee:

Oliver Hunt <oliver>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	fpizlo: review+

Description Oliver Hunt 2012-04-25 15:46:14 PDT

Biolab disaster crashes on ToT

Comment 1 Oliver Hunt 2012-04-25 15:49:31 PDT

Created attachment 138886 [details]
Patch

Comment 2 Filip Pizlo 2012-04-25 15:52:36 PDT

Comment on attachment 138886 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=138886&action=review

r=me with the simplification

> Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp:115
> +            InlineCallFrame& inlineCallFrame = codeBlock()->inlineCallFrames()[i];
> +            CodeBlock* codeBlock = jsCast<FunctionExecutable*>(inlineCallFrame.executable.get())->baselineCodeBlockFor(inlineCallFrame.isCall ? CodeForCall : CodeForConstruct);

baselineCodeBlockForInlineCallFrame(&codeBlock()->inlineCallFrames()[i])

Comment 3 Oliver Hunt 2012-04-25 15:57:15 PDT

Committed r115252: <http://trac.webkit.org/changeset/115252>

Comment 4 Oliver Hunt 2012-04-25 16:00:17 PDT

Committed r115253: <http://trac.webkit.org/changeset/115253>