tree 9487b6916bd3654c40b72dd8e2a835f3f9b1e269
parent 41b15706db8ddd5933d8f72ff47aaa2db1a96af0
author cwzwarich@webkit.org <cwzwarich@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1229132854 +0000
committer cwzwarich@webkit.org <cwzwarich@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1229132854 +0000

2008-12-12  Cameron Zwarich  <zwarich@apple.com>

        Reviewed by Oliver Hunt.

        Bug 22835: Crash during bytecode generation when comparing to null
        <https://bugs.webkit.org/show_bug.cgi?id=22835>
        <rdar://problem/6286749>

        Change the special cases in bytecode generation for comparison to null
        to use tempDestination().

        JavaScriptCore:

        * parser/Nodes.cpp:
        (JSC::BinaryOpNode::emitBytecode):
        (JSC::EqualNode::emitBytecode):

        LayoutTests:

        * fast/js/ignored-result-null-comparison-crash-expected.txt: Added.
        * fast/js/ignored-result-null-comparison-crash.html: Added.
        * fast/js/resources/ignored-result-null-comparison-crash.js: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@39263 268f45cc-cd09-0410-ab3c-d52691b4dbfc