Take this beautiful piece of code: function f(a,b,c) { if (a) Math.abs(b); // or Math.max(b,c) } var o = {valueOf:function(){return print("Working");}} var i = 0 var forceDFGCompile = true; for (; forceDFGCompile&&i < 10000; i++) if (i & 1) f(true, 5.5, 5.6); else f(false, o, i); f(true, o,i); This should output "Working", but does not if the DFG is enabled. This seems to happen to some extent with all the intrinsics. If you set forceDFGCompile to false, it works as expected.
<rdar://problem/11310772>
Returning the result of the intrinsic produces the correct result, so i think this is a DCE bug.
Created attachment 138621 [details] the patch
Working on hacking up some layout tests. Can I get an RS for those too?
Comment on attachment 138621 [details] the patch r=me, rs=me for tests.
Landed in http://trac.webkit.org/changeset/115103
Reopen, because it broke the Qt build: /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: In member function ‘void JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&)’: /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2058: error: ‘isPredictedNumber’ was not declared in this scope
(In reply to comment #7) > Reopen, because it broke the Qt build: > /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: In member function ‘void JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&)’: > /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2058: error: ‘isPredictedNumber’ was not declared in this scope Oh noes! Looking at this now.
(In reply to comment #8) > (In reply to comment #7) > > Reopen, because it broke the Qt build: > > /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: In member function ‘void JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&)’: > > /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2058: error: ‘isPredictedNumber’ was not declared in this scope > > Oh noes! Looking at this now. Oh, it's a stupid typo. Fix on the way.
Build fix for 32-bit landed in http://trac.webkit.org/changeset/115105