Bug 69989

Summary: DFG CFA does not filter structures aggressively enough.
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch
none
the patch - revert some debug stuff oliver: review+

Description Filip Pizlo 2011-10-12 19:13:41 PDT
If you have an abstract value like (Array, TOP) and you filter it against Final then you should get (None, []) - i.e. there does not exist a structure for any value within the abstract value's set, since the abstract value's set is empty.  This was causing some annoying ASSERTs.

I fixed this issue and added even more ASSERTs to catch it sooner.  I tested this against a bunch of websites and it seems to work.
Comment 1 Filip Pizlo 2011-10-12 19:15:10 PDT
Created attachment 110793 [details]
the patch
Comment 2 Filip Pizlo 2011-10-12 19:16:16 PDT
Created attachment 110795 [details]
the patch - revert some debug stuff
Comment 3 Filip Pizlo 2011-10-12 19:19:56 PDT
Landed in r97334.