JavaScript rest function parameter with negative index leads to bad DFG abstract...
authorjfbastien@apple.com <jfbastien@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Nov 2017 21:58:57 +0000 (21:58 +0000)
committerjfbastien@apple.com <jfbastien@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Nov 2017 21:58:57 +0000 (21:58 +0000)
commit202820633bd918f102364a266eda324aa5db539a
tree963344ec74c71be3cb440571305d4ea19e56c1b6
parentc948f375ff237acdf2bf307c8e34d373f858fb5e
JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225239 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/rest-parameter-negative.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h