Bug 90829

Summary:

DFG may get stuck in an infinite fix point if it constant folds a mispredicted node

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, fpizlo, ggaren, msaboff, oliver

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review+

Description Filip Pizlo 2012-07-09 15:50:35 PDT

Patch forthcoming.

Comment 1 Filip Pizlo 2012-07-09 15:50:57 PDT

<rdar://problem/11823843>

Comment 2 Filip Pizlo 2012-07-09 15:55:35 PDT

Created attachment 151339 [details]
the patch

Comment 3 Filip Pizlo 2012-07-09 16:29:12 PDT

Landed in http://trac.webkit.org/changeset/122167