| Summary: | AI rule for MultiPutByOffset executes its effects in the wrong order | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Saam Barati <saam> | ||||
| Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | benjamin, commit-queue, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, webkit-bug-importer, ysuzuki, zhunkibatu | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
Created attachment 350139 [details]
patch
Comment on attachment 350139 [details]
patch
r=me
Comment on attachment 350139 [details] patch Clearing flags on attachment: 350139 Committed r236223: <https://trac.webkit.org/changeset/236223> All reviewed patches have been landed. Closing bug. *** Bug 188694 has been marked as a duplicate of this bug. *** |
Look at this code: ``` observeTransitions(clobberLimit, transitions); if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction) m_state.setIsValid(false); setForNode(node->child2(), resultingValue); if (!!originalValue && !resultingValue) m_state.setIsValid(false); ``` However, we first need to execute the last three lines before the first three lines. This is because that's how the execution of the node happens at runtime. This can lead to bad results when resultingValue is the same as the base, e.g: ``` o.f = o; ```