haikuwebkit/LayoutTests/js/regress-140306.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-140306.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
REGRESSION (r174226): Header on huffingtonpost.com is too large https://bugs.webkit.org/show_bug.cgi?id=140306 Reviewed by Filip Pizlo. Source/JavaScriptCore: BytecodeGenerator::willResolveToArguments() is used to check to see if we can use the arguments register or whether we need to resolve "arguments". If the arguments have been captured, then they are stored in the lexical environment and the arguments register is not used. Changed BytecodeGenerator::willResolveToArguments() to also check to see if the arguments register is captured. Renamed the function to willResolveToArgumentsRegister() to better indicate what we are checking. Aligned 32 and 64 bit paths in ArgumentsRecoveryGenerator::generateFor() for creating an arguments object that was optimized out of an inlined callFrame. The 32 bit path incorrectly calculated the location of the reified callee frame. This alignment resulted in the removal of operationCreateInlinedArgumentsDuringOSRExit() * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::willResolveToArgumentsRegister): (JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister): (JSC::BytecodeGenerator::emitCall): (JSC::BytecodeGenerator::emitConstruct): (JSC::BytecodeGenerator::emitEnumeration): (JSC::BytecodeGenerator::willResolveToArguments): Deleted. * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::BracketAccessorNode::emitBytecode): (JSC::DotAccessorNode::emitBytecode): (JSC::getArgumentByVal): (JSC::ApplyFunctionCallDotNode::emitBytecode): (JSC::ArrayPatternNode::emitDirectBinding): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::ArgumentsRecoveryGenerator::generateFor): * dfg/DFGOperations.cpp: (JSC::operationCreateInlinedArgumentsDuringOSRExit): Deleted. * dfg/DFGOperations.h: (JSC::operationCreateInlinedArgumentsDuringOSRExit): Deleted. LayoutTests: Updated js/arguments-iterator to test changing argument to array values. Removed tests that changed arguments to a string and an object as they were bogus and didn't test what the appeared to test. for .. of works on iterable objects only. Added new regression test, js/regress-140306. * js/arguments-iterator-expected.txt: * js/regress-140306-expected.txt: Added. * js/regress-140306.html: Added. * js/script-tests/arguments-iterator.js: (testEmptyArrayArguments): (testArrayArguments): (testOverwrittenArguments): Deleted. (testNullArguments): Deleted. (testNonArrayLikeArguments): Deleted. * js/script-tests/regress-140306.js: Added. (checkArgs): (applyToArgs): Canonical link: https://commits.webkit.org/158525@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@178591 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-01-16 20:40:22 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-140306.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`