Bug 173743

Summary: The lowering of Identity in the DFG backend needs to use ManualOperandSpeculation
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, cdumez, commit-queue, fpizlo, ggaren, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, ticaiolima, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch
none
patch none

Saam Barati
Reported 2017-06-22 16:26:58 PDT
It already calls speculate(), so it's manual indeed.
Attachments
patch (2.53 KB, patch)
2017-06-22 16:40 PDT, Saam Barati 		no flags
DetailsFormatted DiffDiff
patch (2.53 KB, patch)
2017-06-22 16:41 PDT, Saam Barati 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2017-06-22 16:27:27 PDT
This causes a crash in JSValueOperand constructor on debug builds, if say, the Identity is Identity(String:@node)
Saam Barati
Comment 2 2017-06-22 16:35:51 PDT
<rdar://problem/32932536>
Saam Barati
Comment 3 2017-06-22 16:40:12 PDT
Created attachment 313670 [details] patch
Saam Barati
Comment 4 2017-06-22 16:41:02 PDT
Created attachment 313671 [details] patch
Mark Lam
Comment 5 2017-06-22 16:42:13 PDT
Comment on attachment 313671 [details] patch r=me
WebKit Commit Bot
Comment 6 2017-06-22 17:22:48 PDT
Comment on attachment 313671 [details] patch Clearing flags on attachment: 313671 Committed r218729: <http://trac.webkit.org/changeset/218729>
WebKit Commit Bot
Comment 7 2017-06-22 17:22:50 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.