Bug 127813 - DFG ArrayPop double array mishandles the NaN hole installation
Summary: DFG ArrayPop double array mishandles the NaN hole installation
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks: 127749
  Show dependency tree / graph
 
Reported: 2014-01-28 15:59 PST by Filip Pizlo
Modified: 2014-01-28 18:38 PST (History)
9 users (show)

See Also:

Attachments
the patch (2.25 KB, patch)
2014-01-28 16:00 PST, Filip Pizlo 		no flags Details | Formatted Diff | Diff
the patch (3.49 KB, patch)
2014-01-28 18:32 PST, Filip Pizlo 		no flags Details | Formatted Diff | Diff
the patch (3.57 KB, patch)
2014-01-28 18:33 PST, Filip Pizlo 		mrowe: review+
Details | Formatted Diff | Diff
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2014-01-28 15:59:37 PST 
Patch forthcoming.
Comment 1 Filip Pizlo 2014-01-28 16:00:22 PST 
Created attachment 222522 [details]
the patch
Comment 2 Filip Pizlo 2014-01-28 18:32:50 PST 
Created attachment 222538 [details]
the patch
Comment 3 Filip Pizlo 2014-01-28 18:33:57 PST 
Created attachment 222539 [details]
the patch
Comment 4 Filip Pizlo 2014-01-28 18:38:26 PST 
Landed in http://trac.webkit.org/changeset/162992