84638 2012-04-23 14:49:43 -0700 DFG must keep alive values that it will perform speculations on 2012-04-23 15:44:06 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 fpizlo webkit-unassigned ggaren oldest_to_newest 608038 0 fpizlo 2012-04-23 14:49:43 -0700 Consider the following code: x = o.f; y = x + 1; Where there are no further uses of x or y. If x was an object, then x + 1 would result in a call to x.valueOf(), which could have side effects. Currently if the DFG speculates that x is a number, then it will dead-code-eliminate x + 1 along with the check that x is a number - so a future execution of this code where o.f results in an object with a valueOf() method will result in the valueOf() method not being called, which is wrong. <rdar://problem/11258183> 608039 1 138430 fpizlo 2012-04-23 14:52:06 -0700 Created attachment 138430 the patch 608092 2 ggaren 2012-04-23 15:32:06 -0700 Regression test? 608093 3 fpizlo 2012-04-23 15:32:34 -0700 (In reply to comment #2) > Regression test? Already got one with Oliver's rs. 608113 4 fpizlo 2012-04-23 15:44:06 -0700 Landed in http://trac.webkit.org/changeset/114956 138430 2012-04-23 14:52:06 -0700 2012-04-23 14:54:07 -0700 the patch fixdce_patch_1.diff text/plain 2195 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTE0OTQ3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBA CisyMDEyLTA0LTIzICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg REZHIG11c3Qga2VlcCBhbGl2ZSB2YWx1ZXMgdGhhdCBpdCB3aWxsIHBlcmZvcm0gc3BlY3VsYXRp b25zIG9uCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04 NDYzOAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMTEyNTgxODM+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBkZmcvREZHTm9kZVR5cGUuaDoKKyAg ICAgICAgKERGRyk6CisKIDIwMTItMDQtMjIgIEpvbiBMZWUgIDxqb25sZWVAYXBwbGUuY29tPgog CiAgICAgICAgIFJlbW92ZSBub3RpZmljYXRpb25zIHN1cHBvcnQgb24gTWFjIExpb24uCkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR05vZGVUeXBlLmgKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdOb2RlVHlwZS5oCShyZXZpc2lvbiAxMTQ5MzIp CisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR05vZGVUeXBlLmgJKHdvcmtpbmcgY29w eSkKQEAgLTgwLDE2ICs4MCwxNiBAQCBuYW1lc3BhY2UgSlNDIHsgbmFtZXNwYWNlIERGRyB7CiAg ICAgbWFjcm8oSW50MzJUb0RvdWJsZSwgTm9kZVJlc3VsdE51bWJlcikgXAogICAgIFwKICAgICAv KiBOb2RlcyBmb3IgYXJpdGhtZXRpYyBvcGVyYXRpb25zLiAqL1wKLSAgICBtYWNybyhBcml0aEFk ZCwgTm9kZVJlc3VsdE51bWJlcikgXAotICAgIG1hY3JvKEFyaXRoU3ViLCBOb2RlUmVzdWx0TnVt YmVyKSBcCi0gICAgbWFjcm8oQXJpdGhOZWdhdGUsIE5vZGVSZXN1bHROdW1iZXIpIFwKLSAgICBt YWNybyhBcml0aE11bCwgTm9kZVJlc3VsdE51bWJlcikgXAotICAgIG1hY3JvKEFyaXRoRGl2LCBO b2RlUmVzdWx0TnVtYmVyKSBcCi0gICAgbWFjcm8oQXJpdGhNb2QsIE5vZGVSZXN1bHROdW1iZXIp IFwKLSAgICBtYWNybyhBcml0aEFicywgTm9kZVJlc3VsdE51bWJlcikgXAotICAgIG1hY3JvKEFy aXRoTWluLCBOb2RlUmVzdWx0TnVtYmVyKSBcCi0gICAgbWFjcm8oQXJpdGhNYXgsIE5vZGVSZXN1 bHROdW1iZXIpIFwKLSAgICBtYWNybyhBcml0aFNxcnQsIE5vZGVSZXN1bHROdW1iZXIpIFwKKyAg ICBtYWNybyhBcml0aEFkZCwgTm9kZVJlc3VsdE51bWJlciB8IE5vZGVNdXN0R2VuZXJhdGUpIFwK KyAgICBtYWNybyhBcml0aFN1YiwgTm9kZVJlc3VsdE51bWJlciB8IE5vZGVNdXN0R2VuZXJhdGUp IFwKKyAgICBtYWNybyhBcml0aE5lZ2F0ZSwgTm9kZVJlc3VsdE51bWJlciB8IE5vZGVNdXN0R2Vu ZXJhdGUpIFwKKyAgICBtYWNybyhBcml0aE11bCwgTm9kZVJlc3VsdE51bWJlciB8IE5vZGVNdXN0 R2VuZXJhdGUpIFwKKyAgICBtYWNybyhBcml0aERpdiwgTm9kZVJlc3VsdE51bWJlciB8IE5vZGVN dXN0R2VuZXJhdGUpIFwKKyAgICBtYWNybyhBcml0aE1vZCwgTm9kZVJlc3VsdE51bWJlciB8IE5v ZGVNdXN0R2VuZXJhdGUpIFwKKyAgICBtYWNybyhBcml0aEFicywgTm9kZVJlc3VsdE51bWJlciB8 IE5vZGVNdXN0R2VuZXJhdGUpIFwKKyAgICBtYWNybyhBcml0aE1pbiwgTm9kZVJlc3VsdE51bWJl ciB8IE5vZGVNdXN0R2VuZXJhdGUpIFwKKyAgICBtYWNybyhBcml0aE1heCwgTm9kZVJlc3VsdE51 bWJlciB8IE5vZGVNdXN0R2VuZXJhdGUpIFwKKyAgICBtYWNybyhBcml0aFNxcnQsIE5vZGVSZXN1 bHROdW1iZXIgfCBOb2RlTXVzdEdlbmVyYXRlKSBcCiAgICAgXAogICAgIC8qIEFkZCBvZiB2YWx1 ZXMgbWF5IGVpdGhlciBiZSBhcml0aG1ldGljLCBvciByZXN1bHQgaW4gc3RyaW5nIGNvbmNhdGVu YXRpb24uICovXAogICAgIG1hY3JvKFZhbHVlQWRkLCBOb2RlUmVzdWx0SlMgfCBOb2RlTXVzdEdl bmVyYXRlIHwgTm9kZU1pZ2h0Q2xvYmJlcikgXAo=