Title: [149128] trunk/Source/_javascript_Core
- Revision
- 149128
- Author
- msab...@apple.com
- Date
- 2013-04-25 11:35:04 -0700 (Thu, 25 Apr 2013)
Log Message
32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean
https://bugs.webkit.org/show_bug.cgi?id=115188
Reviewed by Geoffrey Garen.
Changed the RegExpTest node to set the AbstractValue to boolean, since that
what it is.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::executeEffects):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (149127 => 149128)
--- trunk/Source/_javascript_Core/ChangeLog 2013-04-25 18:33:22 UTC (rev 149127)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-04-25 18:35:04 UTC (rev 149128)
@@ -1,3 +1,16 @@
+2013-04-25 Michael Saboff <msab...@apple.com>
+
+ 32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean
+ https://bugs.webkit.org/show_bug.cgi?id=115188
+
+ Reviewed by Geoffrey Garen.
+
+ Changed the RegExpTest node to set the AbstractValue to boolean, since that
+ what it is.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::executeEffects):
+
2013-04-25 Julien Brianceau <jbrianc...@nds.com>
REGRESSION(r137994): Random crashes occur with SH4 JSC.
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (149127 => 149128)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2013-04-25 18:33:22 UTC (rev 149127)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2013-04-25 18:35:04 UTC (rev 149128)
@@ -997,9 +997,12 @@
break;
case RegExpExec:
- case RegExpTest:
forNode(node).makeTop();
break;
+
+ case RegExpTest:
+ forNode(node).set(SpecBoolean);
+ break;
case Jump:
break;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
