RESOLVED FIXED 111783
DFG should not get corrupted IR in the case of code that is dead, unreachable, and contains a chain of nodes that use each other in an untyped way 
https://bugs.webkit.org/show_bug.cgi?id=111783
Summary DFG should not get corrupted IR in the case of code that is dead, unreachable...
Filip Pizlo
Reported 2013-03-07 15:31:47 PST
Patch forthcoming. <rdar://problem/13372094>
Attachments
the patch (30.92 KB, patch)
2013-03-07 15:35 PST, Filip Pizlo 		mhahnenberg: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2013-03-07 15:35:20 PST
Created attachment 192097 [details] the patch
Mark Hahnenberg
Comment 2 2013-03-07 15:41:59 PST
Comment on attachment 192097 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=192097&action=review r=me > Source/JavaScriptCore/dfg/DFGDCEPhase.cpp:162 > + if (edge.needsCheck() && edge.useKind() != UntypedUse) Make this clearer like we discussed.
Filip Pizlo
Comment 3 2013-03-07 15:47:38 PST
Landed in http://trac.webkit.org/changeset/145145
Note You need to log in before you can comment on or make changes to this bug.