RESOLVED FIXED 81583
Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not change throughout the fixpoint 
https://bugs.webkit.org/show_bug.cgi?id=81583
Summary Prediction propagation for UInt32ToNumber incorrectly assumes that outs outco...
Filip Pizlo
Reported 2012-03-19 16:09:19 PDT
That was true before the arithmetic node flags backward-flow was combined with the forward-flow of prediction propagaiton. But it's not true anymore. Patch forthcoming.
Attachments
the patch (1.53 KB, patch)
2012-03-19 16:25 PDT, Filip Pizlo 		msaboff: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2012-03-19 16:25:44 PDT
Created attachment 132709 [details] the patch
Filip Pizlo
Comment 2 2012-03-19 16:38:49 PDT
Landed in http://trac.webkit.org/changeset/111269
Note You need to log in before you can comment on or make changes to this bug.