Bug 147849

Summary: jsc-tailcall: REGRESSION: DFGByteCodeParser fails when a tail call is inside a ternary
Product: WebKit Reporter: Basile Clement <basile_clement>
Component: JavaScriptCoreAssignee: Basile Clement <basile_clement>
Status: RESOLVED FIXED    
Severity: Normal CC: msaboff
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Basile Clement
Reported 2015-08-10 15:45:53 PDT
DFGByteCodeParser erroneously assumes that a tail call is always followed by a return. But it can also be followed by a jump to a return in return c ? f() : 0;.
Attachments
Patch (3.36 KB, patch)
2015-08-11 12:37 PDT, Basile Clement 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Basile Clement
Comment 1 2015-08-11 12:37:09 PDT
Created attachment 258736 [details] Patch
Basile Clement
Comment 2 2015-08-11 12:44:11 PDT
I guess we should make the tests in tail-call-recognize.js run enough to be compiled in all tiers.
Michael Saboff
Comment 3 2015-08-11 13:02:41 PDT
Comment on attachment 258736 [details] Patch r=me
Basile Clement
Comment 4 2015-08-11 13:09:32 PDT
Committed r188282 <http://trac.webkit.org/changeset/188282>.
Csaba Osztrogonác
Comment 5 2015-09-14 10:59:11 PDT
Comment on attachment 258736 [details] Patch Cleared review? from attachment 258736 [details] so that this bug does not appear in http://webkit.org/pending-review. If you would like this patch reviewed, please attach it to a new bug (or re-open this bug before marking it for review again).
Note You need to log in before you can comment on or make changes to this bug.