haikuwebkit/LayoutTests/js/regress-141111.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-141111.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
Crash (DFG assertion) beneath AbstractInterpreter::verifyEdge() @ http://experilous.com/1/planet-generator/2014-09-28/version-1 https://bugs.webkit.org/show_bug.cgi?id=141111 Reviewed by Filip Pizlo. Source/JavaScriptCore: In LowerDFGToLLVM::compileNode(), if we determine while compiling a node that we would have exited, we don't need to process the OSR availability or abstract interpreter. * ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::safelyInvalidateAfterTermination): Broke this out a a separate method since we need to call it at the top and near the bottom of compileNode(). (JSC::FTL::LowerDFGToLLVM::compileNode): LayoutTests: New tests. * js/regress-141111-expected.txt: Added. * js/regress-141111.html: Added. * js/script-tests/regress-141111.js: Added. (MyObject): (foo): (.result): (bar): Canonical link: https://commits.webkit.org/159134@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@179457 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-02-01 03:58:39 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-141111.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`