FTL ScopedArguments GetArrayLength generates incorrect code and crashes in LLVM
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 26 Mar 2015 15:29:57 +0000 (15:29 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 26 Mar 2015 15:29:57 +0000 (15:29 +0000)
commitebf2af3aee564183d5fd4c922f3e3724285712b3
treeb86c41e71315640523731cb982a3d86b0415b0fd
parente6f6cacdedf2aef991675ad0b33919a2614eaa69
FTL ScopedArguments GetArrayLength generates incorrect code and crashes in LLVM
https://bugs.webkit.org/show_bug.cgi?id=143098

Reviewed by Csaba Osztrogon√°c.

* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileGetArrayLength): Fix a typo.
* tests/stress/scoped-arguments-array-length.js: Added. This test previously always crashed in ftl-no-cjit mode.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@182009 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
Source/JavaScriptCore/tests/stress/scoped-arguments-array-length.js [new file with mode: 0644]