Bug 186583 – CFGSimplificationPhase should de-dupe jettisonedBlocks

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

Otherwise, we may crash in removing a predecessor, since predecessor list is now also deduplicated.

[Saam Barati]

This should fix the crash on this test:
js/dom/JSON-stringify.html

introduced by https://trac.webkit.org/changeset/232741/webkit

[Saam Barati]

Created attachment 342622 [details]
patch

I'm in the middle of building, so I still need to test this, but I'm pretty sure it's the correct fix.

[Saam Barati]

Comment on attachment 342622 [details]
patch

I've confirmed this fixes the crash.

[Robin Morisset]

LGTM, but I'm not an official reviewer.

[Ryan Haddad]

Pinging reviewers. We need the fix ASAP as this is affecting EWS.

[WebKit Commit Bot]

Comment on attachment 342622 [details]
patch

Clearing flags on attachment: 342622

Committed r232800: <https://trac.webkit.org/changeset/232800>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/41097203>

[Yusuke Suzuki]

I think ARES-6 is still crashing.
https://arewefastyet.com/#machine=29&view=breakdown&suite=ares6

[Saam Barati]

(In reply to Yusuke Suzuki from comment #9)
> I think ARES-6 is still crashing.
> https://arewefastyet.com/#machine=29&view=breakdown&suite=ares6

Michael is working on a fix

[Yusuke Suzuki]

(In reply to Saam Barati from comment #10)
> (In reply to Yusuke Suzuki from comment #9)
> > I think ARES-6 is still crashing.
> > https://arewefastyet.com/#machine=29&view=breakdown&suite=ares6
> 
> Michael is working on a fix

Nice!