haikuwebkit/LayoutTests/js/regress-140579.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-140579.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
Crash in JSScope::resolve() on tools.ups.com https://bugs.webkit.org/show_bug.cgi?id=140579 Reviewed by Geoffrey Garen. Source/JavaScriptCore: For op_resolve_scope of a global property or variable that needs to check for the var injection check watchpoint, we need to keep the scope around with a Phantom. The baseline JIT slowpath for op_resolve_scope needs the scope value if the watchpoint fired. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): LayoutTests: New regression test. * js/regress-140579-expected.txt: Added. * js/regress-140579.html: Added. * js/script-tests/regress-140579.js: Added. (Test.this.isString): (Test.this.test): (Test): Canonical link: https://commits.webkit.org/158562@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@178629 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-01-18 00:20:49 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-140579.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`