[Webkit-unassigned] [Bug 84638] New: DFG must keep alive values that it will perform speculations on

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=84638

           Summary: DFG must keep alive values that it will perform
                    speculations on
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Keywords: InRadar
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


Consider the following code:

x = o.f;
y = x + 1;

Where there are no further uses of x or y.  If x was an object, then x + 1 would result in a call to x.valueOf(), which could have side effects. Currently if the DFG speculates that x is a number, then it will dead-code-eliminate x + 1 along with the check that x is a number - so a future execution of this code where o.f results in an object with a valueOf() method will result in the valueOf() method not being called, which is wrong.

<rdar://problem/11258183>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.