[Webkit-unassigned] [Bug 144152] New: mayExit() is wrong about Branch nodes: they can exit.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144152

            Bug ID: 144152
           Summary: mayExit() is wrong about Branch nodes: they can exit.
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

With a debug build, going to https://msdn.microsoft.com/en-us/library/ie/2ked96yw(v=vs.94).aspx will trigger an assertion failure because mayExit() lied about Branch nodes not being able to exit.  The code for emitBranch() (and functions it calls) do speculation checks.  So, obviously, it can exit.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150424/73011e68/attachment-0001.html>