DFG NewArray/NewArrayBuffer shouldn't be constructing with negative indexing
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 5 Nov 2013 00:05:02 +0000 (00:05 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 5 Nov 2013 00:05:02 +0000 (00:05 +0000)
commitf6d1f5aee6f1a994ee6dc18ed97110e1e0dabc28
tree225302e24cc31a3898d9e3b8236c8ece77351011
parenta9a25d37399c97549f0dbd7be12b37940e7ba5e2
DFG NewArray/NewArrayBuffer shouldn't be constructing with negative indexing
https://bugs.webkit.org/show_bug.cgi?id=123760
<rdar://problem/15356705>

Reviewed by Mark Hahnenberg and Oliver Hunt.

Source/JavaScriptCore:

* dfg/DFGOperations.cpp:

LayoutTests:

* js/dfg-new-array-buffer-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-buffer-while-having-a-bad-time.html: Added.
* js/dfg-new-array-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-while-having-a-bad-time.html: Added.
* js/script-tests/dfg-new-array-buffer-while-having-a-bad-time.js: Added.
(foo):
* js/script-tests/dfg-new-array-while-having-a-bad-time.js: Added.
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@158608 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/js/dfg-new-array-buffer-while-having-a-bad-time-expected.txt [new file with mode: 0644]
LayoutTests/js/dfg-new-array-buffer-while-having-a-bad-time.html [new file with mode: 0644]
LayoutTests/js/dfg-new-array-while-having-a-bad-time-expected.txt [new file with mode: 0644]
LayoutTests/js/dfg-new-array-while-having-a-bad-time.html [new file with mode: 0644]
LayoutTests/js/script-tests/dfg-new-array-buffer-while-having-a-bad-time.js [new file with mode: 0644]
LayoutTests/js/script-tests/dfg-new-array-while-having-a-bad-time.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGOperations.cpp