Bug 84638 - DFG must keep alive values that it will perform speculations on
Summary: DFG must keep alive values that it will perform speculations on
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2012-04-23 14:49 PDT by Filip Pizlo
Modified: 2012-04-23 15:44 PDT (History)
1 user (show)

See Also:


Attachments
the patch (2.14 KB, patch)
2012-04-23 14:52 PDT, Filip Pizlo
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-04-23 14:49:43 PDT
Consider the following code:

x = o.f;
y = x + 1;

Where there are no further uses of x or y.  If x was an object, then x + 1 would result in a call to x.valueOf(), which could have side effects. Currently if the DFG speculates that x is a number, then it will dead-code-eliminate x + 1 along with the check that x is a number - so a future execution of this code where o.f results in an object with a valueOf() method will result in the valueOf() method not being called, which is wrong.

<rdar://problem/11258183>
Comment 1 Filip Pizlo 2012-04-23 14:52:06 PDT
Created attachment 138430 [details]
the patch
Comment 2 Geoffrey Garen 2012-04-23 15:32:06 PDT
Regression test?
Comment 3 Filip Pizlo 2012-04-23 15:32:34 PDT
(In reply to comment #2)
> Regression test?

Already got one with Oliver's rs.
Comment 4 Filip Pizlo 2012-04-23 15:44:06 PDT
Landed in http://trac.webkit.org/changeset/114956