Bug 199533 - ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero.
Summary: ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decr...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-07-05 15:00 PDT by Mark Lam
Modified: 2019-07-05 17:28 PDT (History)
9 users (show)

See Also:

Attachments
proposed patch. (4.40 KB, patch)
2019-07-05 15:16 PDT, Mark Lam 		fpizlo: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2019-07-05 15:00:20 PDT 
This is a regression introduced in r246075.
Comment 1 Mark Lam 2019-07-05 15:00:52 PDT 
<rdar://problem/52669111>
Comment 2 Mark Lam 2019-07-05 15:16:24 PDT 
Created attachment 373545 [details]
proposed patch.
Comment 3 Mark Lam 2019-07-05 16:06:27 PDT 
Thanks for the review.  Landed in r247183: <http://trac.webkit.org/r247183>.
Comment 4 Saam Barati 2019-07-05 17:28:42 PDT 
Comment on attachment 373545 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=373545&action=review

> Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp:610
> +                        // yet to be processed. Inside the look, it refers to the index

Look => loop