Arguments elimination phase mishandles arity check failure in its reduction of LoadVarargs to GetStack/PutStacks
https://bugs.webkit.org/show_bug.cgi?id=145298
Reviewed by Geoffrey Garen.
* dfg/DFGArgumentsEliminationPhase.cpp: Fix the bug. I restructured the loop to make it more obvious that we're initializing everything that we're supposed to initialize.
* dfg/DFGNode.h: Add a comment to clarify something I was confused about while writing this code.
* dfg/DFGPutStackSinkingPhase.cpp: Hacking on PutStacks made me think deep thoughts, and I added some FIXMEs.
* tests/stress/fold-load-varargs-arity-check-fail-barely.js: Added. This test crashes or fails before this patch.
* tests/stress/fold-load-varargs-arity-check-fail.js: Added. This is even more sure to crash or fail.
* tests/stress/simplify-varargs-mandatory-minimum-smaller-than-limit.js: Added. Not sure if we had coverage for this case before.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@184781 268f45cc-cd09-0410-ab3c-d52691b4dbfc
7 files changed
