[Webkit-unassigned] [Bug 22451] New: There should be a test for the JSC PIC bug that caused the ToT crasher over the weekend.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=22451

           Summary: There should be a test for the JSC PIC bug that caused
                    the ToT crasher over the weekend.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: barraclough at apple.com


The bug is caused by an access to a prototype chain being cached, that doesn't
check for immediates before dereferencing the passed JSValue*.  Write a test
case to force a chained access to be cached, then pass it an immediate.

Should probably also test the non-chained prototype accesses, at the same time.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.