<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>136187</bug_id>
          
          <creation_ts>2014-08-22 17:27:46 -0700</creation_ts>
          <short_desc>REGRESSION(r172794) + 32Bit build: for-in-base-reassigned-later-and-change-structure.js fail with NaN result</short_desc>
          <delta_ts>2014-08-26 10:34:38 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Michael Saboff">msaboff</reporter>
          <assigned_to name="Michael Saboff">msaboff</assigned_to>
          <cc>fpizlo</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1030851</commentid>
    <comment_count>0</comment_count>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2014-08-22 17:27:46 -0700</bug_when>
    <thetext>+++ This bug was initially created as a clone of Bug #136165 +++

This bug is to track the for-in-base-reassigned-later-and-change-structure.js failures and Bug #136165 will be used to track the ASSERT failures.

The following JavaScriptCore regression tests are failing after r172794 &lt;http://trac.webkit.org/changeset/172794&gt;:

	stress/for-in-base-reassigned-later-and-change-structure.js.always-trigger-copy-phase
	stress/for-in-base-reassigned-later-and-change-structure.js.default
	stress/for-in-base-reassigned-later-and-change-structure.js.default-ftl
	stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager
	stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager-no-cjit-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager-no-cjit
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-no-inline-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.no-cjit-validate-phases
	stress/for-in-base-reassigned-later-and-change-structure.js.no-llint

All of these &quot;for-in-base-reassigned-later-and-change-structure.js&quot; fail with &quot;Exception: Error: bad result: NaN&quot;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1031324</commentid>
    <comment_count>1</comment_count>
      <attachid>237135</attachid>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2014-08-25 22:38:40 -0700</bug_when>
    <thetext>Created attachment 237135
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1031374</commentid>
    <comment_count>2</comment_count>
      <attachid>237135</attachid>
    <who name="Mark Hahnenberg">mhahnenb</who>
    <bug_when>2014-08-26 07:43:40 -0700</bug_when>
    <thetext>Comment on attachment 237135
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1031401</commentid>
    <comment_count>3</comment_count>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2014-08-26 10:34:38 -0700</bug_when>
    <thetext>Committed r172962: &lt;http://trac.webkit.org/changeset/172962&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>237135</attachid>
            <date>2014-08-25 22:38:40 -0700</date>
            <delta_ts>2014-08-26 07:43:39 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>136187.patch</filename>
            <type>text/plain</type>
            <size>3274</size>
            <attacher name="Michael Saboff">msaboff</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTcyOTUwKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBA
CisyMDE0LTA4LTI1ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg
ICAgIFJFR1JFU1NJT04ocjE3Mjc5NCkgKyAzMkJpdCBidWlsZDogZm9yLWluLWJhc2UtcmVhc3Np
Z25lZC1sYXRlci1hbmQtY2hhbmdlLXN0cnVjdHVyZS5qcyBmYWlsIHdpdGggTmFOIHJlc3VsdAor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM2MTg3CisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkZWQgdHdv
IGFyZyB2ZXJzaW9uIGZvciAzMiBiaXQgYnVpbGRzIG9mIGNhbGxPcGVyYXRpb24oSl9KSVRPcGVy
YXRpb25fRUNKLCAuLi4pIHRoYXQKKyAgICAgICAgZG9lc24ndCByZXF1aXJlIGEgdGFnIGZvciB0
aGUgc2Vjb25kIGFyZ3VtZW50LCBpbnN0ZWFkIGl0IGZpbGxzIGluIGEgQ2VsbFRhZy4gIFRoaXMg
aXMKKyAgICAgICAgdXNlZCBmb3IgdGhlIHNsb3cgY2FzZSBvZiB0aGUgR2V0RGlyZWN0UG5hbWUg
Y2FzZSBpbiBTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZSBzaW5jZSB3ZQorICAgICAgICBoYXZlbid0
IHNldCB1cCBhIHJlZ2lzdGVyIHdpdGggYSB0YWcgYW5kIHdlIGtub3cgdGhhdCBhcmd1bWVudCAy
IGlzIGEgY2VsbC4KKworICAgICAgICAqIGRmZy9ERkdTcGVjdWxhdGl2ZUpJVC5oOgorICAgICAg
ICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjYWxsT3BlcmF0aW9uKTogTmV3IHZlcnNpb24g
d2l0aCBpbXBsaWNpdCBDZWxsVGFnLgorICAgICAgICAqIGRmZy9ERkdTcGVjdWxhdGl2ZUpJVDMy
XzY0LmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZSk6IEVs
aW1pbmF0ZWQgZXh0cmFuZW91cyBmaWxsaW5nIG9mIHRoZSBzY3JhdGNoR1BSCisgICAgICAgIHdp
dGggQ2VsbFRhZyBhcyBpdCB3YXNuJ3QgaW4gdGhlIGNvbnRyb2wgZmxvdyBmb3IgdGhlIHNsb3cg
cGF0aCB0aGF0IG5lZWRlZCB0aGUgdGFnLgorICAgICAgICBJbnN0ZWFkIGNoYW5nZWQgdG8gY2Fs
bGluZyBuZXcgdmVyc2lvbiBvZiBjYWxsT3BlcmF0aW9uIHdpdGggYW4gaW1wbGljaXQgQ2VsbFRh
Zy4KKwogMjAxNC0wOC0yNSAgU2FhbSBCYXJhdGkgIDxzYmFyYXRpQGFwcGxlLmNvbT4KIAogICAg
ICAgICBUeXBlUHJvZmlsZXIgc2VhcmNoIGJyZWFrcyBvbiByZXR1cm4gc3RhdGVtZW50cwpJbmRl
eDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVDMyXzY0LmNwcAo9
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklU
MzJfNjQuY3BwCShyZXZpc2lvbiAxNzI5NDApCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZn
L0RGR1NwZWN1bGF0aXZlSklUMzJfNjQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00NzczLDggKzQ3
NzMsNyBAQCB2b2lkIFNwZWN1bGF0aXZlSklUOjpjb21waWxlKE5vZGUqIG5vZGUpCiAKICAgICAg
ICAgZG9uZS5saW5rKCZtX2ppdCk7CiAKLSAgICAgICAgbV9qaXQubW92ZShNYWNyb0Fzc2VtYmxl
cjo6VHJ1c3RlZEltbTMyKEpTVmFsdWU6OkNlbGxUYWcpLCBzY3JhdGNoR1BSKTsKLSAgICAgICAg
YWRkU2xvd1BhdGhHZW5lcmF0b3Ioc2xvd1BhdGhDYWxsKHdyb25nU3RydWN0dXJlLCB0aGlzLCBv
cGVyYXRpb25HZXRCeVZhbENlbGwsIHJlc3VsdFRhZ0dQUiwgcmVzdWx0UGF5bG9hZEdQUiwgYmFz
ZUdQUiwgc2NyYXRjaEdQUiwgcHJvcGVydHlHUFIpKTsKKyAgICAgICAgYWRkU2xvd1BhdGhHZW5l
cmF0b3Ioc2xvd1BhdGhDYWxsKHdyb25nU3RydWN0dXJlLCB0aGlzLCBvcGVyYXRpb25HZXRCeVZh
bENlbGwsIHJlc3VsdFRhZ0dQUiwgcmVzdWx0UGF5bG9hZEdQUiwgYmFzZUdQUiwgcHJvcGVydHlH
UFIpKTsKIAogICAgICAgICBqc1ZhbHVlUmVzdWx0KHJlc3VsdFRhZ0dQUiwgcmVzdWx0UGF5bG9h
ZEdQUiwgbm9kZSk7CiAgICAgICAgIGJyZWFrOwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3Jl
L2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0
Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuaAkocmV2aXNpb24gMTcyOTQwKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5oCSh3b3JraW5nIGNvcHkpCkBA
IC0xNjk1LDYgKzE2OTUsMTEgQEAgcHVibGljOgogICAgICAgICBtX2ppdC5zZXR1cEFyZ3VtZW50
c1dpdGhFeGVjU3RhdGUoYXJnMSwgYXJnMlBheWxvYWQsIGFyZzJUYWcpOwogICAgICAgICByZXR1
cm4gYXBwZW5kQ2FsbFdpdGhFeGNlcHRpb25DaGVja1NldFJlc3VsdChvcGVyYXRpb24sIHJlc3Vs
dFBheWxvYWQsIHJlc3VsdFRhZyk7CiAgICAgfQorICAgIEpJVENvbXBpbGVyOjpDYWxsIGNhbGxP
cGVyYXRpb24oSl9KSVRPcGVyYXRpb25fRUNKIG9wZXJhdGlvbiwgR1BSUmVnIHJlc3VsdFRhZywg
R1BSUmVnIHJlc3VsdFBheWxvYWQsIEdQUlJlZyBhcmcxLCBHUFJSZWcgYXJnMlBheWxvYWQpCisg
ICAgeworICAgICAgICBtX2ppdC5zZXR1cEFyZ3VtZW50c1dpdGhFeGVjU3RhdGUoYXJnMSwgYXJn
MlBheWxvYWQsIE1hY3JvQXNzZW1ibGVyOjpUcnVzdGVkSW1tMzIoSlNWYWx1ZTo6Q2VsbFRhZykp
OworICAgICAgICByZXR1cm4gYXBwZW5kQ2FsbFdpdGhFeGNlcHRpb25DaGVja1NldFJlc3VsdChv
cGVyYXRpb24sIHJlc3VsdFBheWxvYWQsIHJlc3VsdFRhZyk7CisgICAgfQogICAgIEpJVENvbXBp
bGVyOjpDYWxsIGNhbGxPcGVyYXRpb24oSl9KSVRPcGVyYXRpb25fRUNKIG9wZXJhdGlvbiwgSlNW
YWx1ZVJlZ3MgcmVzdWx0LCBHUFJSZWcgYXJnMSwgSlNWYWx1ZVJlZ3MgYXJnMikKICAgICB7CiAg
ICAgICAgIG1faml0LnNldHVwQXJndW1lbnRzV2l0aEV4ZWNTdGF0ZShhcmcxLCBhcmcyLnBheWxv
YWRHUFIoKSwgYXJnMi50YWdHUFIoKSk7Cg==
</data>
<flag name="review"
          id="261840"
          type_id="1"
          status="+"
          setter="mhahnenb"
    />
          </attachment>
      

    </bug>

</bugzilla>