tree 090444ef7539100ab2e65e2c305e322816045855
parent bc478a036df6be8c4037af82400376f9656de329
author sbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571359345 +0000
committer sbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571359345 +0000

GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap
https://bugs.webkit.org/show_bug.cgi?id=203124
<rdar://problem/55988183>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/licm-array-storage-get-and-put-by-val.js: Added.
(assert):
(foo):

Source/JavaScriptCore:

* dfg/DFGAbstractHeap.h:
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251271 268f45cc-cd09-0410-ab3c-d52691b4dbfc