JSC fails to compile for (;;) { try { eval("NaN = 0"); } catch(e) {} } Due to a parse failure of Dynamic put
Created attachment 208838 [details] Patch
Comment on attachment 208838 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review > Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178 > + // If we're writing to a readonly property we emit a Dynamic put that > + // the DFG can't currently handle. Really?
Comment on attachment 208838 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review >> Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178 >> + // the DFG can't currently handle. > > Really? Oh, yeah, really.
Committed r154120: <http://trac.webkit.org/changeset/154120>
Comment on attachment 208838 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review > Source/JavaScriptCore/dfg/DFGCapabilities.cpp:186 > - ResolveType resolveType = static_cast<ResolveType>(pc[3].u.operand); > + ResolveType resolveType = ResolveModeAndType(pc[4].u.operand).type(); Why? It appears that the DFG bytecodeparser and the bytecompiler both put the type in 3, not 4.