[Webkit-unassigned] [Bug 24752] New: REGRESSION (r36802): two testapi tests fail with the JIT enabled

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=24752

           Summary: REGRESSION (r36802): two testapi tests fail with the JIT
                    enabled
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.5
            Status: NEW
          Keywords: Regression
          Severity: Normal
          Priority: P1
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: cwzwarich at uwaterloo.ca
                CC: oliver at apple.com


The following two testapi tests fail with the JIT:

__FAIL__: myObject instanceof MyObject should be true but instead is TypeError:
instanceof called on an object with an invalid prototype property..
__FAIL__: (new Object()) instanceof MyObject should be false but instead is
TypeError: instanceof called on an object with an invalid prototype property..

This is caused by the inlining of JSObject::hasInstance() into the instanceof
JIT stub function in r36802. That code should be wrapped with a check that the
object doesn't override instanceof.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.