Changeset 194164 in webkit for trunk/Source/JavaScriptCore/dfg/DFGUnificationPhase.cpp

Timestamp:

Dec 16, 2015, 11:10:55 AM (9 years ago)

Author:

[email protected]

Message:

Work around a bug in LLVM by flipping the unification order
​https://bugs.webkit.org/show_bug.cgi?id=152341
rdar://problem/23920749

Reviewed by Mark Lam.

• dfg/DFGUnificationPhase.cpp:

(JSC::DFG::UnificationPhase::run):

File:

• trunk/Source/JavaScriptCore/dfg/DFGUnificationPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGUnificationPhase.cpp

@@ -60 +60 @@
                     if (!phi->children.child(childIdx))
                         break;
-                    
-                    phi->children.child(childIdx)->variableAccessData()->unify(phi->variableAccessData());
+
+                    // We'd like to reverse the order of unification because it helps to reveal
+                    // more bugs on our end, though it's otherwise not observable. But we do it
+                    // this way because it works around a bug in open source LLVM's live-outs
+                    // computation.
+                    phi->variableAccessData()->unify(phi->children.child(childIdx)->variableAccessData());
                 }
             }