[Webkit-unassigned] [Bug 144152] New: mayExit() is wrong about Branch nodes: they can exit.
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Apr 24 10:41:29 PDT 2015
https://bugs.webkit.org/show_bug.cgi?id=144152
Bug ID: 144152
Summary: mayExit() is wrong about Branch nodes: they can exit.
Classification: Unclassified
Product: WebKit
Version: 528+ (Nightly build)
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: mark.lam at apple.com
With a debug build, going to https://msdn.microsoft.com/en-us/library/ie/2ked96yw(v=vs.94).aspx will trigger an assertion failure because mayExit() lied about Branch nodes not being able to exit. The code for emitBranch() (and functions it calls) do speculation checks. So, obviously, it can exit.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150424/73011e68/attachment-0001.html>
More information about the webkit-unassigned
mailing list