Currently, the globalTypeSet which stores the convergence of all types that represent the return type for a function live off CodeBlock. But this is based on a bad assumption that CodeBlock has a one to one mapping with a function in the source code of a program. We want the globalTypeSet of a return statement to live off an object that has a one to one mapping with functions in the source code of a program. Currently, return type sets in CodeBlock that go into the TypeLocation object aren't duplicated because TypeLocationCache will hash cons the TypeSet into the same TypeLocation, but it's still a faulty assumption that should be corrected.
Created attachment 237048 [details] patch Solves the problem by placing the TypeSet on FunctionExecutable.
Comment on attachment 237048 [details] patch Clearing flags on attachment: 237048 Committed r172949: <http://trac.webkit.org/changeset/172949>
All reviewed patches have been landed. Closing bug.