[webkit-reviews] review granted: [Bug 176948] It should be valid to exit before each set when doing arity fixup when inlining : [Attachment 320833] patch

[bugzilla-daemon at webkit.org]

Keith Miller <keith_miller at apple.com> has granted Saam Barati
<sbarati at apple.com>'s request for review:
Bug 176948: It should be valid to exit before each set when doing arity fixup
when inlining
https://bugs.webkit.org/show_bug.cgi?id=176948

Attachment 320833: patch

https://bugs.webkit.org/attachment.cgi?id=320833&action=review




--- Comment #7 from Keith Miller <keith_miller at apple.com> ---
Comment on attachment 320833
  --> https://bugs.webkit.org/attachment.cgi?id=320833
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=320833&action=review

r=me.

> Source/JavaScriptCore/ChangeLog:14
> +	   Not doing this led to a bug where FixupPhase would insert a ValueRep
of
> +	   a node before the actual node. This is obviously invalid IR. I've
added
> +	   a new validation rule to catch this malformed IR.

Crazy!