DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 22 Oct 2018 19:07:37 +0000 (19:07 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 22 Oct 2018 19:07:37 +0000 (19:07 +0000)
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>

Rubber-stamped by Saam Barati.

Adding another test.

* stress/regress-190515-2.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@237326 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/regress-190515-2.js [new file with mode: 0644]

index 0387532..97a5e3a 100644 (file)
@@ -4,6 +4,18 @@
         https://bugs.webkit.org/show_bug.cgi?id=190515
         <rdar://problem/45222379>
 
+        Rubber-stamped by Saam Barati.
+
+        Adding another test.
+
+        * stress/regress-190515-2.js: Added.
+
+2018-10-22  Mark Lam  <mark.lam@apple.com>
+
+        DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
+        https://bugs.webkit.org/show_bug.cgi?id=190515
+        <rdar://problem/45222379>
+
         Reviewed by Saam Barati.
 
         * stress/regress-190515.js: Added.
diff --git a/JSTests/stress/regress-190515-2.js b/JSTests/stress/regress-190515-2.js
new file mode 100644 (file)
index 0000000..f76053c
--- /dev/null
@@ -0,0 +1,15 @@
+//@ requireOptions("--jitPolicyScale=0")
+
+// This test should not crash.
+
+function test(array) {
+    return array.push(0, 0.1);
+}
+
+for (var i = 0; i < 100000; ++i) {
+    test([])
+}
+
+for (var i = 0; i < 100000; ++i) {
+    test([0])
+}