haikuwebkit/LayoutTests/js/regress-140033.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-140033.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
Crash in operationNewFunction when scrolling on Google+ https://bugs.webkit.org/show_bug.cgi?id=140033 Reviewed by Oliver Hunt. Source/JavaScriptCore: In DFG code, the scope register can be eliminated because all uses have been dead code eliminated. In the case where one of the uses was creating a function that is never used, the baseline code will still create the function. If we OSR exit to a path where that function gets created, check the scope register value and set the new, but dead, function to undefined instead of creating a new function. * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_new_func_exp): LayoutTests: New regerssion test. * js/regress-140033-expected.txt: Added. * js/regress-140033.html: Added. * js/script-tests/regress-140033.js: Added. (.unused): (defineADeadFunction): Canonical link: https://commits.webkit.org/158029@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@177871 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-01-04 03:47:25 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-140033.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`