DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
https://bugs.webkit.org/show_bug.cgi?id=90407
Reviewed by Mark Hahnenberg.
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121712 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 26f9f3f..40b4b7e 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,13 @@
+2012-07-02 Filip Pizlo <fpizlo@apple.com>
+
+ DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
+ https://bugs.webkit.org/show_bug.cgi?id=90407
+
+ Reviewed by Mark Hahnenberg.
+
+ * dfg/DFGArgumentsSimplificationPhase.cpp:
+ (JSC::DFG::ArgumentsSimplificationPhase::run):
+
2012-07-02 Gavin Barraclough <barraclough@apple.com>
Array.prototype.pop should throw if property is not configurable
