projects / platform / upstream / v8.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 5d14639) | patch
Simpler repro for bug 2989.
authorjarin@chromium.org <jarin@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Fri, 31 Jan 2014 16:12:58 +0000 (16:12 +0000)
committerjarin@chromium.org <jarin@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Fri, 31 Jan 2014 16:12:58 +0000 (16:12 +0000)
commit3c2363f4b4766623f3fad66715fc028d7ddd576c
tree62bf2714794483075fe67f4e7d1c216f2d2ffcb9tree | snapshot
parent5d14639576db70fef5153431f60fb76c5a90bbf2commit | diff
Simpler repro for bug 2989.

We do not correctly handle accesses to f.arguments after one
of the argument has changed (where f is crankshafted).

R=machenbach@chromium.org
BUG=v8:2989
LOG=n

Review URL: https://codereview.chromium.org/151403003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
test/mjsunit/mjsunit.status diff | blob | history
test/mjsunit/regress/regress-2989.js [new file with mode: 0644] blob
test/webkit/webkit.status diff | blob | history
Domain: Web Framework / Web Engine;