Bug 111783

Summary:

DFG should not get corrupted IR in the case of code that is dead, unreachable, and contains a chain of nodes that use each other in an untyped way

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	mhahnenberg: review+

Description Filip Pizlo 2013-03-07 15:31:47 PST

Patch forthcoming.

<rdar://problem/13372094>

Comment 1 Filip Pizlo 2013-03-07 15:35:20 PST

Created attachment 192097 [details]
the patch

Comment 2 Mark Hahnenberg 2013-03-07 15:41:59 PST

Comment on attachment 192097 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=192097&action=review

r=me

> Source/JavaScriptCore/dfg/DFGDCEPhase.cpp:162
> +            if (edge.needsCheck() && edge.useKind() != UntypedUse)

Make this clearer like we discussed.

Comment 3 Filip Pizlo 2013-03-07 15:47:38 PST

Landed in http://trac.webkit.org/changeset/145145