Bug 81583

Summary:

Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not change throughout the fixpoint

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	msaboff: review+

Filip Pizlo

Reported 2012-03-19 16:09:19 PDT

That was true before the arithmetic node flags backward-flow was combined with the forward-flow of prediction propagaiton. But it's not true anymore. Patch forthcoming.

Attachments
the patch (1.53 KB, patch) 2012-03-19 16:25 PDT, Filip Pizlo	msaboff: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2012-03-19 16:25:44 PDT

Created attachment 132709 [details] the patch

Filip Pizlo

Comment 2 2012-03-19 16:38:49 PDT

Landed in http://trac.webkit.org/changeset/111269

Note You need to log in before you can comment on or make changes to this bug.