[Webkit-unassigned] [Bug 161492] ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=161492

--- Comment #2 from Filip Pizlo <fpizlo at apple.com> ---
100% repro:


function bar()
{
}

noInline(bar);

function foo(p, x)
{
    var value = 1;
    function inc()
    {
        return value + 1;
    }
    function dec()
    {
        return value - 1;
    }

    if (!p)
        return 0;

    bar(inc);

    x += 2000000000;

    value = 42;
    return dec();
}

noInline(foo);

function test(x)
{
    var result = foo(true, x);
    if (result != 42 - 1)
        throw "Error: bad result: " + result;
}

for (var i = 0; i < 100000; ++i)
    test(0);

test(2000000000);

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160901/88a57be4/attachment.html>