Bug 133368

Summary:

DFG::DCEPhase inserts into an insertion set in reverse, causing hilarious basic block corruption if you kill a lot of NewArrays

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

New Bugs

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, cmarcelo, commit-queue

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none
Patch	mark.lam: review+

Filip Pizlo

Reported 2014-05-28 18:36:03 PDT

DFG::DCEPhase inserts into an insertion set in reverse, causing hilarious basic block corruption if you kill a lot of NewArrays

Attachments
Patch (4.83 KB, patch) 2014-05-28 18:37 PDT, Filip Pizlo	no flags	Details Formatted Diff Diff
Patch (4.82 KB, patch) 2014-05-28 18:43 PDT, Filip Pizlo	mark.lam: review+	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2014-05-28 18:37:41 PDT

Filip Pizlo

Comment 2 2014-05-28 18:43:37 PDT

Mark Lam

Comment 3 2014-05-29 08:01:16 PDT

Filip Pizlo

Comment 4 2014-05-29 09:10:55 PDT

Note You need to log in before you can comment on or make changes to this bug.