-
oliver@apple.com authored
https://bugs.webkit.org/show_bug.cgi?id=121710 Reviewed by Filip Pizlo. Source/JavaScriptCore: Don't claim to be able to rely on the arguments structure, use the Arguments speculation type * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::::executeEffects): LayoutTests: New test case * js/dfg-arguments-mutated-structure-expected.txt: Added. * js/dfg-arguments-mutated-structure.html: Added. * js/script-tests/dfg-arguments-mutated-structure.js: Added. (foo): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156211 268f45cc-cd09-0410-ab3c-d52691b4dbfc
83ec76bb