Bug 22451 - There should be a test for the JSC PIC bug that caused the ToT crasher over the weekend.
Summary: There should be a test for the JSC PIC bug that caused the ToT crasher over t...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P2 Normal
Assignee: Gavin Barraclough
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-11-24 02:40 PST by Gavin Barraclough
Modified: 2008-11-25 17:52 PST (History)
0 users

See Also:


Attachments
A test (2.63 KB, patch)
2008-11-24 03:00 PST, Gavin Barraclough
eric: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Gavin Barraclough 2008-11-24 02:40:04 PST
The bug is caused by an access to a prototype chain being cached, that doesn't check for immediates before dereferencing the passed JSValue*.  Write a test case to force a chained access to be cached, then pass it an immediate.

Should probably also test the non-chained prototype accesses, at the same time.
Comment 1 Gavin Barraclough 2008-11-24 03:00:36 PST
Created attachment 25421 [details]
A test
Comment 2 Gavin Barraclough 2008-11-24 03:12:08 PST
Sending        LayoutTests/ChangeLog
Adding         LayoutTests/fast/js/pic/cached-prototype-then-immediate-expected.txt
Adding         LayoutTests/fast/js/pic/cached-prototype-then-immediate.html
Transmitting file data ...
Committed revision 38703.

Comment 3 Eric Seidel (no email) 2008-11-25 17:52:45 PST
Comment on attachment 25421 [details]
A test

Silly bugzilla.  Clearing review flag since this landed.