| Summary: | DFG should not forget that it had proved something to be a constant during a merge just because it's merging against the empty value | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> | ||||
| Component: | JavaScriptCore | Assignee: | Filip Pizlo <fpizlo> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 106690 | ||||||
| Attachments: |
|
||||||
|
Description
Filip Pizlo
2013-01-11 22:14:52 PST
Created attachment 182458 [details]
the patch
This blocks https://bugs.webkit.org/show_bug.cgi?id=106690 because it slightly masks that bug. When trying to come up with a reduced case of that other bug, I couldn't, because the CFA was artificially dumbing itself down so that it became too dumb to make the mistake that that bug fixes. :-/ Landed in http://trac.webkit.org/changeset/139688 |