[Webkit-unassigned] [Bug 115949] Window Object TypeError: 'undefined' is not an object (evaluating 'this.document')

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=115949





--- Comment #7 from Youngho Yoo <youngho33.yoo at lge.com>  2013-05-23 10:18:44 PST ---
(In reply to comment #6)

I found what was a problem.

in Source/JavaScriptCore/dfg/DFGFixupPhase.cpp,
void fixupNode(Node* node) function.
case GetById: 

If I remove setUseKindAndUnboxIfProfitable<CellUse>(node->child1());,
then There is no TypeError.

There is some traditional compiler optimzing method, name was liveness analysis.
And setUseKindAndUnboxIfProfitable role is marking for doing liveness analysis.
I don't know yet this is only the our platform problem or not.
But if we doing liveness analysis with HTMLDocument(in Top object) object,
It will unbox(remove) that object when even if JSC still needs that object.

I will check this problem in detail.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.