Bug 136187 - REGRESSION(r172794) + 32Bit build: for-in-base-reassigned-later-and-change-structure.js fail with NaN result
Summary: REGRESSION(r172794) + 32Bit build: for-in-base-reassigned-later-and-change-st...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Michael Saboff
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-08-22 17:27 PDT by Michael Saboff
Modified: 2014-08-26 10:34 PDT (History)
1 user (show)

See Also:


Attachments
Patch (3.20 KB, patch)
2014-08-25 22:38 PDT, Michael Saboff
mhahnenb: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Saboff 2014-08-22 17:27:46 PDT
+++ This bug was initially created as a clone of Bug #136165 +++

This bug is to track the for-in-base-reassigned-later-and-change-structure.js failures and Bug #136165 will be used to track the ASSERT failures.

The following JavaScriptCore regression tests are failing after r172794 <http://trac.webkit.org/changeset/172794>:

	stress/for-in-base-reassigned-later-and-change-structure.js.always-trigger-copy-phase
	stress/for-in-base-reassigned-later-and-change-structure.js.default
	stress/for-in-base-reassigned-later-and-change-structure.js.default-ftl
	stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager
	stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager-no-cjit-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager-no-cjit
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-no-inline-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.no-cjit-validate-phases
	stress/for-in-base-reassigned-later-and-change-structure.js.no-llint

All of these "for-in-base-reassigned-later-and-change-structure.js" fail with "Exception: Error: bad result: NaN"
Comment 1 Michael Saboff 2014-08-25 22:38:40 PDT
Created attachment 237135 [details]
Patch
Comment 2 Mark Hahnenberg 2014-08-26 07:43:40 PDT
Comment on attachment 237135 [details]
Patch

r=me
Comment 3 Michael Saboff 2014-08-26 10:34:38 PDT
Committed r172962: <http://trac.webkit.org/changeset/172962>