commit eca9fbe16ebca782d709e44fc1890ff32294b410
author oliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sun Jul 28 18:04:18 2013 +0000
committer oliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sun Jul 28 18:04:18 2013 +0000
tree 03b673871efbf446c3598daf1a1d2c1eb71c6c7a
parent af9bf60eb6eea103e3dba15be71d11ba2b550956

REGRESSION: Crash when opening Facebook.com
https://bugs.webkit.org/show_bug.cgi?id=119155

Reviewed by Andreas Kling.

Scope nodes are always objects, so we should be using SpecObjectOther
rather than SpecCellOther.  Marking Scopes as CellOther leads to a
contradiction in the CFA, resulting in bogus codegen.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153410 268f45cc-cd09-0410-ab3c-d52691b4dbfc