<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>176429</bug_id>
          
          <creation_ts>2017-09-05 16:21:09 -0700</creation_ts>
          <short_desc>isNotCellSpeculation is wrong with respect to SpecEmpty</short_desc>
          <delta_ts>2017-09-27 12:37:43 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Saam Barati">saam</reporter>
          <assigned_to name="Saam Barati">saam</assigned_to>
          <cc>benjamin</cc>
    
    <cc>commit-queue</cc>
    
    <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
    
    <cc>gskachkov</cc>
    
    <cc>jfbastien</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>rmorisset</cc>
    
    <cc>ticaiolima</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1345695</commentid>
    <comment_count>0</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-09-05 16:21:09 -0700</bug_when>
    <thetext>this may lead to OSR exit loops.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1345698</commentid>
    <comment_count>1</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-09-05 16:26:17 -0700</bug_when>
    <thetext>Consider something like this:
a: JSConstant(JSValue())

If we ask @a in Fixup if shouldSpeculateNotCell, it&apos;ll return true. NotCellUse on @a will OSR exit, since it passes the cell check.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1345714</commentid>
    <comment_count>2</comment_count>
      <attachid>319956</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-09-05 16:48:12 -0700</bug_when>
    <thetext>Created attachment 319956
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1345715</commentid>
    <comment_count>3</comment_count>
      <attachid>319956</attachid>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2017-09-05 16:50:58 -0700</bug_when>
    <thetext>Comment on attachment 319956
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=319956&amp;action=review

r=me

&gt; Source/JavaScriptCore/ChangeLog:9
&gt; +        the SpecEmpty in the set for t. It should return false when the SpecEmpty is present,

nit - Is &quot;the&quot; before the second SpecEmpty unnecessary?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1345717</commentid>
    <comment_count>4</comment_count>
      <attachid>319956</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-09-05 16:52:31 -0700</bug_when>
    <thetext>Comment on attachment 319956
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=319956&amp;action=review

&gt;&gt; Source/JavaScriptCore/ChangeLog:9
&gt;&gt; +        the SpecEmpty in the set for t. It should return false when the SpecEmpty is present,
&gt; 
&gt; nit - Is &quot;the&quot; before the second SpecEmpty unnecessary?

it is. removed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1345721</commentid>
    <comment_count>5</comment_count>
      <attachid>319959</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-09-05 16:54:39 -0700</bug_when>
    <thetext>Created attachment 319959
patch for landing</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1345742</commentid>
    <comment_count>6</comment_count>
      <attachid>319959</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2017-09-05 18:18:19 -0700</bug_when>
    <thetext>Comment on attachment 319959
patch for landing

Clearing flags on attachment: 319959

Committed r221657: &lt;http://trac.webkit.org/changeset/221657&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1345743</commentid>
    <comment_count>7</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2017-09-05 18:18:21 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1353543</commentid>
    <comment_count>8</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2017-09-27 12:37:43 -0700</bug_when>
    <thetext>&lt;rdar://problem/34693636&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>319956</attachid>
            <date>2017-09-05 16:48:12 -0700</date>
            <delta_ts>2017-09-05 16:54:39 -0700</delta_ts>
            <desc>patch</desc>
            <filename>c-backup.diff</filename>
            <type>text/plain</type>
            <size>2763</size>
            <attacher name="Saam Barati">saam</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyMjE2NDgpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDEzIEBACisyMDE3LTA5LTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu
Y29tPgorCisgICAgICAgIGlzTm90Q2VsbFNwZWN1bGF0aW9uIGlzIHdyb25nIHcuci50IFNwZWND
ZWxsQ2hlY2sKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk
PTE3NjQyOQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg
ICogbWljcm9iZW5jaG1hcmtzL2lzLW5vdC1jZWxsLXNwZWN1bGF0aW9uLWZvci1lbXB0eS12YWx1
ZS5qczogQWRkZWQuCisgICAgICAgIChGb28pOgorCiAyMDE3LTA5LTA1ICBKb3NlcGggUGVjb3Jh
cm8gIDxwZWNvcmFyb0BhcHBsZS5jb20+CiAKICAgICAgICAgdGVzdDI2MjogQ29tcGxldGlvbiB2
YWx1ZXMgZm9yIGNvbnRyb2wgZmxvdyBkbyBub3QgbWF0Y2ggdGhlIHNwZWMKSW5kZXg6IEpTVGVz
dHMvbWljcm9iZW5jaG1hcmtzL2lzLW5vdC1jZWxsLXNwZWN1bGF0aW9uLWZvci1lbXB0eS12YWx1
ZS5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3RzL21pY3JvYmVuY2htYXJrcy9pcy1ub3QtY2VsbC1z
cGVjdWxhdGlvbi1mb3ItZW1wdHktdmFsdWUuanMJKG5vbmV4aXN0ZW50KQorKysgSlNUZXN0cy9t
aWNyb2JlbmNobWFya3MvaXMtbm90LWNlbGwtc3BlY3VsYXRpb24tZm9yLWVtcHR5LXZhbHVlLmpz
CSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTMgQEAKK2NsYXNzIEZvbyBleHRlbmRzIE9iamVj
dCB7CisgICAgY29uc3RydWN0b3IoKSB7CisgICAgICAgIHN1cGVyKCk7CisgICAgICAgIGxldCBh
cnJvdyA9ICgpID0+IHsKKyAgICAgICAgICAgIHRoaXMuZm9vID0gMjA7CisgICAgICAgIH07Cisg
ICAgICAgIHRoaXMuYXJyb3cgPSBhcnJvdzsKKyAgICB9Cit9Citub0lubGluZShGb28pOworCitm
b3IgKGxldCBpID0gMDsgaSA8IDQwMDAwMDsgKytpKQorICAgIG5ldyBGb28oKTsKSW5kZXg6IFNv
dXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFT
Y3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjIxNjQyKQorKysgU291cmNlL0phdmFTY3Jp
cHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE3LTA5
LTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAgIGlzTm90Q2Vs
bFNwZWN1bGF0aW9uIGlzIHdyb25nIHcuci50IFNwZWNDZWxsQ2hlY2sKKyAgICAgICAgaHR0cHM6
Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3NjQyOQorCisgICAgICAgIFJldmll
d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBpc05vdENlbGxTcGVjdWxhdGlv
bihTcGVjdWxhdGVkVHlwZSB0KSBmdW5jdGlvbiB3YXMgbm90IHRha2luZyBpbnRvIGFjY291bnQK
KyAgICAgICAgdGhlIFNwZWNFbXB0eSBpbiB0aGUgc2V0IGZvciB0LiBJdCBzaG91bGQgcmV0dXJu
IGZhbHNlIHdoZW4gdGhlIFNwZWNFbXB0eSBpcyBwcmVzZW50LAorICAgICAgICBzaW5jZSB0aGUg
ZW1wdHkgdmFsdWUgd2lsbCBmYWlsIGEgTm90Q2VsbCBjaGVjay4gVGhpcyBidWcgd291bGQgY2F1
c2UgdXMgdG8gZXJyb25lb3VzbHkKKyAgICAgICAgZ2VuZXJhdGUgTm90Q2VsbFVzZSBVc2VLaW5k
cyBmb3IgaW5wdXRzIHRoYXQgYXJlIHRoZSBlbXB0eSB2YWx1ZSwgY2F1c2luZyByZXBlYXRlZCBP
U1IgZXhpdHMuCisKKyAgICAgICAgKiBieXRlY29kZS9TcGVjdWxhdGVkVHlwZS5oOgorICAgICAg
ICAoSlNDOjppc05vdENlbGxTcGVjdWxhdGlvbik6CisKIDIwMTctMDktMDUgIFNhYW0gQmFyYXRp
ICA8c2JhcmF0aUBhcHBsZS5jb20+CiAKICAgICAgICAgTWFrZSB0aGUgZGlzdGluY3Rpb24gYmV0
d2VlbiBlbnRyeXBvaW50cyBhbmQgQ0ZHIHJvb3RzIG1vcmUgY2xlYXIgYnkgbmFtaW5nIHRoaW5n
cyBiZXR0ZXIKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9TcGVjdWxhdGVk
VHlwZS5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9TcGVj
dWxhdGVkVHlwZS5oCShyZXZpc2lvbiAyMjE2NDIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUv
Ynl0ZWNvZGUvU3BlY3VsYXRlZFR5cGUuaAkod29ya2luZyBjb3B5KQpAQCAtMTE5LDcgKzExOSw3
IEBAIGlubGluZSBib29sIGlzQ2VsbE9yT3RoZXJTcGVjdWxhdGlvbihTcGUKIAogaW5saW5lIGJv
b2wgaXNOb3RDZWxsU3BlY3VsYXRpb24oU3BlY3VsYXRlZFR5cGUgdmFsdWUpCiB7Ci0gICAgcmV0
dXJuICEodmFsdWUgJiBTcGVjQ2VsbCkgJiYgdmFsdWU7CisgICAgcmV0dXJuICEodmFsdWUgJiBT
cGVjQ2VsbENoZWNrKSAmJiB2YWx1ZTsKIH0KIAogaW5saW5lIGJvb2wgaXNPYmplY3RTcGVjdWxh
dGlvbihTcGVjdWxhdGVkVHlwZSB2YWx1ZSkK
</data>
<flag name="review"
          id="340127"
          type_id="1"
          status="+"
          setter="msaboff"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>319959</attachid>
            <date>2017-09-05 16:54:39 -0700</date>
            <delta_ts>2017-09-05 18:18:19 -0700</delta_ts>
            <desc>patch for landing</desc>
            <filename>c-backup.diff</filename>
            <type>text/plain</type>
            <size>2767</size>
            <attacher name="Saam Barati">saam</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyMjE2NDgpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDEzIEBACisyMDE3LTA5LTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu
Y29tPgorCisgICAgICAgIGlzTm90Q2VsbFNwZWN1bGF0aW9uIGlzIHdyb25nIHdpdGggcmVzcGVj
dCB0byBTcGVjRW1wdHkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu
Y2dpP2lkPTE3NjQyOQorCisgICAgICAgIFJldmlld2VkIGJ5IE1pY2hhZWwgU2Fib2ZmLgorCisg
ICAgICAgICogbWljcm9iZW5jaG1hcmtzL2lzLW5vdC1jZWxsLXNwZWN1bGF0aW9uLWZvci1lbXB0
eS12YWx1ZS5qczogQWRkZWQuCisgICAgICAgIChGb28pOgorCiAyMDE3LTA5LTA1ICBKb3NlcGgg
UGVjb3Jhcm8gIDxwZWNvcmFyb0BhcHBsZS5jb20+CiAKICAgICAgICAgdGVzdDI2MjogQ29tcGxl
dGlvbiB2YWx1ZXMgZm9yIGNvbnRyb2wgZmxvdyBkbyBub3QgbWF0Y2ggdGhlIHNwZWMKSW5kZXg6
IEpTVGVzdHMvbWljcm9iZW5jaG1hcmtzL2lzLW5vdC1jZWxsLXNwZWN1bGF0aW9uLWZvci1lbXB0
eS12YWx1ZS5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3RzL21pY3JvYmVuY2htYXJrcy9pcy1ub3Qt
Y2VsbC1zcGVjdWxhdGlvbi1mb3ItZW1wdHktdmFsdWUuanMJKG5vbmV4aXN0ZW50KQorKysgSlNU
ZXN0cy9taWNyb2JlbmNobWFya3MvaXMtbm90LWNlbGwtc3BlY3VsYXRpb24tZm9yLWVtcHR5LXZh
bHVlLmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTMgQEAKK2NsYXNzIEZvbyBleHRlbmRz
IE9iamVjdCB7CisgICAgY29uc3RydWN0b3IoKSB7CisgICAgICAgIHN1cGVyKCk7CisgICAgICAg
IGxldCBhcnJvdyA9ICgpID0+IHsKKyAgICAgICAgICAgIHRoaXMuZm9vID0gMjA7CisgICAgICAg
IH07CisgICAgICAgIHRoaXMuYXJyb3cgPSBhcnJvdzsKKyAgICB9Cit9Citub0lubGluZShGb28p
OworCitmb3IgKGxldCBpID0gMDsgaSA8IDQwMDAwMDsgKytpKQorICAgIG5ldyBGb28oKTsKSW5k
ZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjIxNjQyKQorKysgU291cmNlL0ph
dmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisy
MDE3LTA5LTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAgIGlz
Tm90Q2VsbFNwZWN1bGF0aW9uIGlzIHdyb25nIHdpdGggcmVzcGVjdCB0byBTcGVjRW1wdHkKKyAg
ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3NjQyOQorCisg
ICAgICAgIFJldmlld2VkIGJ5IE1pY2hhZWwgU2Fib2ZmLgorCisgICAgICAgIFRoZSBpc05vdENl
bGxTcGVjdWxhdGlvbihTcGVjdWxhdGVkVHlwZSB0KSBmdW5jdGlvbiB3YXMgbm90IHRha2luZyBp
bnRvIGFjY291bnQKKyAgICAgICAgU3BlY0VtcHR5IGluIHRoZSBzZXQgZm9yIHQuIEl0IHNob3Vs
ZCByZXR1cm4gZmFsc2Ugd2hlbiBTcGVjRW1wdHkgaXMgcHJlc2VudCwgc2luY2UKKyAgICAgICAg
dGhlIGVtcHR5IHZhbHVlIHdpbGwgZmFpbCBhIE5vdENlbGwgY2hlY2suIFRoaXMgYnVnIHdvdWxk
IGNhdXNlIHVzIHRvIGVycm9uZW91c2x5CisgICAgICAgIGdlbmVyYXRlIE5vdENlbGxVc2UgVXNl
S2luZHMgZm9yIGlucHV0cyB0aGF0IGFyZSB0aGUgZW1wdHkgdmFsdWUsIGNhdXNpbmcgcmVwZWF0
ZWQgT1NSIGV4aXRzLgorCisgICAgICAgICogYnl0ZWNvZGUvU3BlY3VsYXRlZFR5cGUuaDoKKyAg
ICAgICAgKEpTQzo6aXNOb3RDZWxsU3BlY3VsYXRpb24pOgorCiAyMDE3LTA5LTA1ICBTYWFtIEJh
cmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgogCiAgICAgICAgIE1ha2UgdGhlIGRpc3RpbmN0aW9u
IGJldHdlZW4gZW50cnlwb2ludHMgYW5kIENGRyByb290cyBtb3JlIGNsZWFyIGJ5IG5hbWluZyB0
aGluZ3MgYmV0dGVyCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvU3BlY3Vs
YXRlZFR5cGUuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUv
U3BlY3VsYXRlZFR5cGUuaAkocmV2aXNpb24gMjIxNjQyKQorKysgU291cmNlL0phdmFTY3JpcHRD
b3JlL2J5dGVjb2RlL1NwZWN1bGF0ZWRUeXBlLmgJKHdvcmtpbmcgY29weSkKQEAgLTExOSw3ICsx
MTksNyBAQCBpbmxpbmUgYm9vbCBpc0NlbGxPck90aGVyU3BlY3VsYXRpb24oU3BlCiAKIGlubGlu
ZSBib29sIGlzTm90Q2VsbFNwZWN1bGF0aW9uKFNwZWN1bGF0ZWRUeXBlIHZhbHVlKQogewotICAg
IHJldHVybiAhKHZhbHVlICYgU3BlY0NlbGwpICYmIHZhbHVlOworICAgIHJldHVybiAhKHZhbHVl
ICYgU3BlY0NlbGxDaGVjaykgJiYgdmFsdWU7CiB9CiAKIGlubGluZSBib29sIGlzT2JqZWN0U3Bl
Y3VsYXRpb24oU3BlY3VsYXRlZFR5cGUgdmFsdWUpCg==
</data>

          </attachment>
      

    </bug>

</bugzilla>