tree b3b971a25e014f850c444bcf5d95f8985317c8bc
parent 748be6e46ea9331d8f631d291b3c0b196e95458e
author rmorisset@apple.com <rmorisset@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557520627 +0000
committer rmorisset@apple.com <rmorisset@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557520627 +0000

testb3 failing with crash in JSC::B3::BasicBlock::appendNonTerminal
https://bugs.webkit.org/show_bug.cgi?id=197756
<rdar://problem/50641659>

Reviewed by Saam Barati.

When I added https://bugs.webkit.org/show_bug.cgi?id=197265 I assumed that which block is the root does not change in the middle of strength reduction.
But specializeSelect can use splitForward, which uses a new block for the first half of the given block.
So if the block being split is the root block I must update m_root and erase the m_valueInConstant cache.
Erasing the cache cannot cause wrong results: at most it can make us miss some optimization opportunities in this iteration of the fixpoint.

* b3/B3ReduceStrength.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@245192 268f45cc-cd09-0410-ab3c-d52691b4dbfc