[Webkit-unassigned] [Bug 158631] New: We shouldn't crash if DFG AI proved that something was unreachable on one run but then decided not to prove it in the backend

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=158631

            Bug ID: 158631
           Summary: We shouldn't crash if DFG AI proved that something was
                    unreachable on one run but then decided not to prove
                    it in the backend
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: fpizlo at apple.com

It's possible that due to concurrency, we invalidate the compilation after the last run of the CFA phase but before the backend. Then, when AI runs during the backend, it might think that some code that was previously thought to be Unreachable is now reachable.  We shouldn't crash when this happens.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160610/3aa93af0/attachment.html>