Bug 133368

Summary:

DFG::DCEPhase inserts into an insertion set in reverse, causing hilarious basic block corruption if you kill a lot of NewArrays

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

New Bugs

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, cmarcelo, commit-queue

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none
Patch	mark.lam: review+

Description Filip Pizlo 2014-05-28 18:36:03 PDT

DFG::DCEPhase inserts into an insertion set in reverse, causing hilarious basic block corruption if you kill a lot of NewArrays

Comment 1 Filip Pizlo 2014-05-28 18:37:41 PDT

Created attachment 232226 [details]
Patch

Comment 2 Filip Pizlo 2014-05-28 18:43:37 PDT

Created attachment 232227 [details]
Patch

Comment 3 Mark Lam 2014-05-29 08:01:16 PDT

Comment on attachment 232227 [details]
Patch

r=me

Comment 4 Filip Pizlo 2014-05-29 09:10:55 PDT

Landed in http://trac.webkit.org/changeset/169447