Bug 111783

Summary: DFG should not get corrupted IR in the case of code that is dead, unreachable, and contains a chain of nodes that use each other in an untyped way
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Description Flags
the patch mhahnenberg: review+

Description Filip Pizlo 2013-03-07 15:31:47 PST
Patch forthcoming.

Comment 1 Filip Pizlo 2013-03-07 15:35:20 PST
Created attachment 192097 [details]
the patch
Comment 2 Mark Hahnenberg 2013-03-07 15:41:59 PST
Comment on attachment 192097 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=192097&action=review


> Source/JavaScriptCore/dfg/DFGDCEPhase.cpp:162
> +            if (edge.needsCheck() && edge.useKind() != UntypedUse)

Make this clearer like we discussed.
Comment 3 Filip Pizlo 2013-03-07 15:47:38 PST
Landed in http://trac.webkit.org/changeset/145145