Bug 111783 - DFG should not get corrupted IR in the case of code that is dead, unreachable, and contains a chain of nodes that use each other in an untyped way
Summary: DFG should not get corrupted IR in the case of code that is dead, unreachable...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
Keywords: InRadar
Depends on:
Reported: 2013-03-07 15:31 PST by Filip Pizlo
Modified: 2013-03-07 15:47 PST (History)
7 users (show)

See Also:

the patch (30.92 KB, patch)
2013-03-07 15:35 PST, Filip Pizlo
mhahnenberg: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-03-07 15:31:47 PST
Patch forthcoming.

Comment 1 Filip Pizlo 2013-03-07 15:35:20 PST
Created attachment 192097 [details]
the patch
Comment 2 Mark Hahnenberg 2013-03-07 15:41:59 PST
Comment on attachment 192097 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=192097&action=review


> Source/JavaScriptCore/dfg/DFGDCEPhase.cpp:162
> +            if (edge.needsCheck() && edge.useKind() != UntypedUse)

Make this clearer like we discussed.
Comment 3 Filip Pizlo 2013-03-07 15:47:38 PST
Landed in http://trac.webkit.org/changeset/145145