[Webkit-unassigned] [Bug 164309] DFG plays fast and loose with the shadow values of a Phi

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=164309

--- Comment #12 from Filip Pizlo <fpizlo at apple.com> ---
(In reply to comment #11)
> Comment on attachment 293741 [details]
> it's a start
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=293741&action=review
> 
> > Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp:-124
> > -            //    p: Phi()
> 
> Maybe this is too simplistic, but why can't we just solve the liveness bug
> by saying:
> 
> p: Phi() => defs p
> 
> n: Upsilon(@x, ^p) => defs n, uses x
> 
> Maybe I'm not completely understanding the implications of such a rule?

I don't see how your rule works. Upsilon is void so I don't know what it means to def it. Also in your rule nobody uses the upsilon.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161103/ff92f156/attachment-0001.html>