We have code in OSR exit that sets up length, but not capacity. This means get_from_arguments may end up loading an empty value, instead of undefined. We rely on it DirectArguments having at least up to the number of declared parameters slots being undefined if there are no arguments to the actual function
The test case ``` function foo(a, b) { let x = arguments; OSRExit(); return a + b; // Will load JSValue() instead of jsUndefined() since we'll materialize a DirectArguments in OSRExit that only has slots filled with JSValue() } function bar() { foo(); } noInline(bar); for (let i = 0; i < 1000; ++i) { bar(); } ```
<rdar://problem/38415177>
Created attachment 343118 [details] patch
Comment on attachment 343118 [details] patch Clearing flags on attachment: 343118 Committed r233000: <https://trac.webkit.org/changeset/233000>
All reviewed patches have been landed. Closing bug.