RESOLVED FIXED 173743
The lowering of Identity in the DFG backend needs to use ManualOperandSpeculation 
https://bugs.webkit.org/show_bug.cgi?id=173743
Summary The lowering of Identity in the DFG backend needs to use ManualOperandSpecula...
Saam Barati
Reported 2017-06-22 16:26:58 PDT
It already calls speculate(), so it's manual indeed.
Attachments
patch (2.53 KB, patch)
2017-06-22 16:40 PDT, Saam Barati 		no flags
DetailsFormatted DiffDiff
patch (2.53 KB, patch)
2017-06-22 16:41 PDT, Saam Barati 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2017-06-22 16:27:27 PDT
This causes a crash in JSValueOperand constructor on debug builds, if say, the Identity is Identity(String:@node)
Saam Barati
Comment 2 2017-06-22 16:35:51 PDT
<rdar://problem/32932536>
Saam Barati
Comment 3 2017-06-22 16:40:12 PDT
Created attachment 313670 [details] patch
Saam Barati
Comment 4 2017-06-22 16:41:02 PDT
Created attachment 313671 [details] patch
Mark Lam
Comment 5 2017-06-22 16:42:13 PDT
Comment on attachment 313671 [details] patch r=me
WebKit Commit Bot
Comment 6 2017-06-22 17:22:48 PDT
Comment on attachment 313671 [details] patch Clearing flags on attachment: 313671 Committed r218729: <http://trac.webkit.org/changeset/218729>
WebKit Commit Bot
Comment 7 2017-06-22 17:22:50 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.