Bug 197855 – Bound liveness of SetArgumentMaybe nodes when maximal flush insertion phase is enabled

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Tadeu Zagallo]

...

[Tadeu Zagallo]

Created attachment 369794 [details]
Patch

[Tadeu Zagallo]

<rdar://problem/50236506>

[Saam Barati]

I thought about this a bit, and I'd be sad for this to go. It's helped us find a lot of bugs. Posting an alternative patch here that fixes the crash in radar

[Saam Barati]

Created attachment 369802 [details]
maybe patch

[EWS Watchlist]

Comment on attachment 369794 [details]
Patch

Attachment 369794 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/12185088

New failing tests:
fast/shadow-dom/svg-use-href-change-in-shadow-tree.html

[EWS Watchlist]

Created attachment 369823 [details]
Archive of layout-test-results from ews210 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews210  Port: win-future  Platform: CYGWIN_NT-10.0-17763-3.0.5-338.x86_64-x86_64-64bit

[Tadeu Zagallo]

(In reply to Saam Barati from comment #3)
> I thought about this a bit, and I'd be sad for this to go. It's helped us
> find a lot of bugs. Posting an alternative patch here that fixes the crash
> in radar

I think it's a bit unfortunate having to special case it to make it work, but it's a pretty simple patch, so sounds good to me. If ever run into this again we can reconsider. Do you want to go ahead and take the bug?

[Saam Barati]

Created attachment 369898 [details]
patch

[Saam Barati]

Here is another test I'll check in that crashes with:  --useMaximalFlushInsertionPhase=1 --jitPolicyScale=0 --useConcurrentJIT=0

```
function f0() {
}

function bar() {
  f0(...arguments);
}

const a = new Uint8Array(1);

function foo() {
  bar(0, 0);
  a.find(()=>{});
}


for (let i=0; i<3; i++) {
  foo();
}
```

[Michael Saboff]

Comment on attachment 369898 [details]
patch

r=me

[Saam Barati]

landed in:
https://trac.webkit.org/changeset/245341/webkit