[Webkit-unassigned] [Bug 196116] New: Remove an invalid assertion in DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined().

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=196116

            Bug ID: 196116
           Summary: Remove an invalid assertion in
                    DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareN
                    ullOrUndefined().
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

The DFG backend should not make assumptions about what optimizations the front end will or will not do.  The assertion asserts that the operand cannot be known to be a cell.  However, it is not guaranteed that the front end will fold away this case.  Also, the DFG backend is perfectly capable of generating code to handle the case where the operand is a cell.

<rdar://problem/48976951>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190321/0308c2f0/attachment.html>