RESOLVED FIXED 65397
LayoutTests does not have a test for array speculation pathologies in the JavaScriptCore DFG JIT 
https://bugs.webkit.org/show_bug.cgi?id=65397
Summary LayoutTests does not have a test for array speculation pathologies in the Jav...
Filip Pizlo
Reported 2011-07-29 15:07:57 PDT
The JavaScriptCore DFG JIT may speculate that a value is an array. The code is relatively tricky, since a distinction is made between speculating that a variable is an array throughout the entire procedure, versus speculating that a variable happens to reference an array during the course of a particular array access. The latter code path has not been exercised in existing tests, so a new test is needed.
Attachments
the patch (4.65 KB, patch)
2011-07-29 15:12 PDT, Filip Pizlo 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-07-29 15:12:41 PDT
Created attachment 102404 [details] the patch
Darin Adler
Comment 2 2011-07-29 18:06:36 PDT
Comment on attachment 102404 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=102404&action=review > LayoutTests/fast/js/array-type-speculation-expected.txt:6 > +PASS result is "foo" When possible, it's better to construct the test so that you can see what is being tested in the test output. Just seeing "result" is not so great. One way to do that is to make sure that the argument to shouldBe itself contains arguments that make it clear which test is which. But I know that with JavaScript testing it can be tricky to achieve that since different ways of executing code exercise different code paths.
WebKit Review Bot
Comment 3 2011-07-29 19:07:12 PDT
Comment on attachment 102404 [details] the patch Clearing flags on attachment: 102404 Committed r92040: <http://trac.webkit.org/changeset/92040>
WebKit Review Bot
Comment 4 2011-07-29 19:07:17 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.