[Webkit-unassigned] [Bug 159603] New: REGRESSION(201900): validation failure for GetByOffset/PutByOffset in VALIDATE((node), node->child1().node() == node->child2().node() || node->child1()->result() == NodeResultStorage)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=159603

            Bug ID: 159603
           Summary: REGRESSION(201900): validation failure for
                    GetByOffset/PutByOffset in VALIDATE((node),
                    node->child1().node() == node->child2().node() ||
                    node->child1()->result() == NodeResultStorage)
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: fpizlo at apple.com

This validation rule is broken.  It should always be valid to take:

Foo(@x, @x)

and turn it into:

a: ValueRep(@x)
b: ValueRep(@x)
Foo(@a, @b)

or:

y: Identity(@x)
Foo(@x, @y)

That's because it should be possible to rewire any data flow edge something that produces an equivalent value.  This validation rule means that such rewirings are invalid on GetByOffset/PutByOffset.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160709/b1529fd0/attachment.html>