DFG NewArray/NewArrayBuffer shouldn't be constructing with negative indexing
https://bugs.webkit.org/show_bug.cgi?id=123760
<rdar://problem/15356705>
Reviewed by Mark Hahnenberg and Oliver Hunt.
Source/JavaScriptCore:
* dfg/DFGOperations.cpp:
LayoutTests:
* js/dfg-new-array-buffer-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-buffer-while-having-a-bad-time.html: Added.
* js/dfg-new-array-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-while-having-a-bad-time.html: Added.
* js/script-tests/dfg-new-array-buffer-while-having-a-bad-time.js: Added.
(foo):
* js/script-tests/dfg-new-array-while-having-a-bad-time.js: Added.
(foo):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158608 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/js/dfg-new-array-buffer-while-having-a-bad-time.html b/LayoutTests/js/dfg-new-array-buffer-while-having-a-bad-time.html
new file mode 100644
index 0000000..a676ffb
--- /dev/null
+++ b/LayoutTests/js/dfg-new-array-buffer-while-having-a-bad-time.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/dfg-new-array-buffer-while-having-a-bad-time.js"></script>
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
