150824 2015-11-02 16:48:13 -0800 Re-investiage using PhantomLocal as the liveness preservation mechanism for variables live in a "catch" block in the DFG 2017-08-21 11:53:23 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified NEW P2 Normal --- 1 saam saam benjamin fpizlo ggaren gskachkov jfbastien keith_miller mark.lam msaboff oliver ticaiolima ysuzuki oldest_to_newest 1138766 0 saam 2015-11-02 16:48:13 -0800 Look at this bug for why we had to revert to Flush: https://bugs.webkit.org/show_bug.cgi?id=150760 1242541 1 saam 2016-10-20 12:55:03 -0700 Ok, so I was looking at other code, but realized maybe why there was a bug in the first place w/ GetById. DFGSpeculativeJIT64.cpp calls SpeculateCellOperand::use() on the base before compiling the IC. This might effect OSR exit data if the GetById is the last use of the base. I suspect this is why PhantomLocal was broken in that program. This also means that we should probably look at other use() calls to make sure they're sound w.r.t exceptions. 1340676 2 saam 2017-08-21 11:53:23 -0700 It looks like there is a strength reduction rule that may rewrite Flush to PhantomLocal, and it has no concept of exception handling. So there is a chance there is some program that breaks because of the use() call and a Flush being rewritten as PhantomLocal.