RESOLVED DUPLICATE of bug 109389 109388
Implicit type check on local variables hoisting is unsound with respect to CFG simplification 
https://bugs.webkit.org/show_bug.cgi?id=109388
Summary Implicit type check on local variables hoisting is unsound with respect to CF...
Filip Pizlo
Reported 2013-02-10 14:06:20 PST
We may hoist int, number, cell, or boolean checks into SetLocals. But we do so implicitly - the SetLocal doesn't "know" that it has this check; the CFA and the backend end up just deciding to put checks there without telling anyone else. So, if you CFG simplify and get rid of a SetLocal that had a type check that you had used to construct some proof, then you're going to have a really bad time.
Attachments
Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2013-02-10 14:55:40 PST
The best way to solve this is to explicitly have the Fixup phase shove type checks into Phantom nodes with appropriate Edges that are just above the SetLocal. Then CFG simplification will be able to "just work" and not worry about this. This of course relies on https://bugs.webkit.org/show_bug.cgi?id=109371.
Filip Pizlo
Comment 2 2013-02-28 12:43:51 PST
My current approach to fixing this is to handle it as part of DCE hardening. *** This bug has been marked as a duplicate of bug 109389 ***
Note You need to log in before you can comment on or make changes to this bug.