NEW157534
[JSC] It should be possible to always safely move GetByVal 
https://bugs.webkit.org/show_bug.cgi?id=157534
Summary [JSC] It should be possible to always safely move GetByVal
Benjamin Poulain
Reported 2016-05-10 13:57:27 PDT
FTL had a but where GetByVal would be moved by Loop Invariant Code Motion invalidating assumption used to remove bounds checking (see https://bugs.webkit.org/show_bug.cgi?id=157502). The fix was to move IntegerRange optimization after LICM to make sure the code is not moved after CheckInBounds is eliminated. It would be better to have a deterministic way of knowing if a GetByVal can be moved and where it is safe to move it. For example, it should be explicitly illegal to hoist a GetByVal above its CheckInBounds.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2016-05-10 14:00:39 PDT
<rdar://problem/26204263>
Note You need to log in before you can comment on or make changes to this bug.