Bug 173743

Summary: The lowering of Identity in the DFG backend needs to use ManualOperandSpeculation
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, cdumez, commit-queue, fpizlo, ggaren, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, ticaiolima, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch
none
patch none

Description Saam Barati 2017-06-22 16:26:58 PDT 
It already calls speculate(), so it's manual indeed.
Comment 1 Saam Barati 2017-06-22 16:27:27 PDT 
This causes a crash in JSValueOperand constructor on debug builds, if say, the Identity is Identity(String:@node)
Comment 2 Saam Barati 2017-06-22 16:35:51 PDT 
<rdar://problem/32932536>
Comment 3 Saam Barati 2017-06-22 16:40:12 PDT 
Created attachment 313670 [details]
patch
Comment 4 Saam Barati 2017-06-22 16:41:02 PDT 
Created attachment 313671 [details]
patch
Comment 5 Mark Lam 2017-06-22 16:42:13 PDT 
Comment on attachment 313671 [details]
patch

r=me
Comment 6 WebKit Commit Bot 2017-06-22 17:22:48 PDT 
Comment on attachment 313671 [details]
patch

Clearing flags on attachment: 313671

Committed r218729: <http://trac.webkit.org/changeset/218729>
Comment 7 WebKit Commit Bot 2017-06-22 17:22:50 PDT 
All reviewed patches have been landed.  Closing bug.