haikuwebkit/LayoutTests/js/regress-142792.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-142792.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
Objects with numeric properties intermittently get a phantom 'length' property https://bugs.webkit.org/show_bug.cgi?id=142792 Reviewed by Csaba Osztrogonác. Source/JavaScriptCore: Fixed a > (greater than) that should be a >> (right shift) in the code that disassembles test and branch instructions. This function is used for linking tbz/tbnz branches between two seperately JIT'ed sections of code. Sometime we'd create a bogus tbz instruction in the failure case checks in the GetById array length stub created for "obj.length" access. If the failure case code address was at a negative offset from the stub, we'd look for bit 1 being set when we should have been looking for bit 0. * assembler/ARM64Assembler.h: (JSC::ARM64Assembler::disassembleTestAndBranchImmediate): LayoutTests: New regression test. * js/regress-142792-expected.txt: Added. * js/regress-142792.html: Added. * js/script-tests/regress-142792.js: Added. (isArrayLike): (filter): Canonical link: https://commits.webkit.org/161164@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@182058 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-03-27 14:28:34 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-142792.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`