Bug 81583 - Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not change throughout the fixpoint
Summary: Prediction propagation for UInt32ToNumber incorrectly assumes that outs outco...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-19 16:09 PDT by Filip Pizlo
Modified: 2012-03-19 16:38 PDT (History)
0 users

See Also:

Attachments
the patch (1.53 KB, patch)
2012-03-19 16:25 PDT, Filip Pizlo 		msaboff: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-03-19 16:09:19 PDT 
That was true before the arithmetic node flags backward-flow was combined with the forward-flow of prediction propagaiton.  But it's not true anymore.

Patch forthcoming.
Comment 1 Filip Pizlo 2012-03-19 16:25:44 PDT 
Created attachment 132709 [details]
the patch
Comment 2 Filip Pizlo 2012-03-19 16:38:49 PDT 
Landed in http://trac.webkit.org/changeset/111269