commit 59d1ddb232ef32dd748423b4204bc49d004aeee9
author fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Nov 05 00:05:02 2013 +0000
committer fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Nov 05 00:05:02 2013 +0000
tree 225302e24cc31a3898d9e3b8236c8ece77351011
parent ac780d11dd89e29554a35a16608611e6a099837e

DFG NewArray/NewArrayBuffer shouldn't be constructing with negative indexing
https://bugs.webkit.org/show_bug.cgi?id=123760
<rdar://problem/15356705>

Reviewed by Mark Hahnenberg and Oliver Hunt.

Source/JavaScriptCore: 

* dfg/DFGOperations.cpp:

LayoutTests: 

* js/dfg-new-array-buffer-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-buffer-while-having-a-bad-time.html: Added.
* js/dfg-new-array-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-while-having-a-bad-time.html: Added.
* js/script-tests/dfg-new-array-buffer-while-having-a-bad-time.js: Added.
(foo):
* js/script-tests/dfg-new-array-while-having-a-bad-time.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158608 268f45cc-cd09-0410-ab3c-d52691b4dbfc