CommonSlowPath's slow_path_get_direct_pname() currently assumes that the baseValue is always a non-constant register. However, this is not always the case like in the following: function foo() { var o = { a:1 }; for (var n in o) 0[n]; }; foo(); <rdar://problem/18495847>
Created attachment 241135 [details] the patch.
Comment on attachment 241135 [details] the patch. The code change looks fine. The test changes are change to the test beyond just adding cases for the fix. Therefore please break out the test enhancements as a separate patch.
Created attachment 241142 [details] take 2: minus test refactoring
Comment on attachment 241142 [details] take 2: minus test refactoring r=me
Thanks for the review. Landed in r175724: <http://trac.webkit.org/r175724>.
It looks like this broke 3 JSC tests: https://build.webkit.org/builders/Apple%20Yosemite%2032-bit%20JSC%20%28BuildAndTest%29?numbuilds=100
(In reply to comment #6) > It looks like this broke 3 JSC tests: > https://build.webkit.org/builders/Apple%20Yosemite%2032- > bit%20JSC%20%28BuildAndTest%29?numbuilds=100 Iām looking into it.
(In reply to comment #6) > It looks like this broke 3 JSC tests: > https://build.webkit.org/builders/Apple%20Yosemite%2032- > bit%20JSC%20%28BuildAndTest%29?numbuilds=100 The issue is due to a latent bug that is uncovered by the new tests. I'll skip the tests (from the JSC test set) temporarily while I debug the issue. This work is tracked in https://bugs.webkit.org/show_bug.cgi?id=138497.