[webkit-reviews] review denied: [Bug 90728] REGRESSION(r118555): Assertion failure in JSC::DFG::AssemblyHelpers::decodedCodeMapFor on MathJax v2.0 sample : [Attachment 165632] a simple fix

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Yong Li <yoli at rim.com>'s request for
review:
Bug 90728: REGRESSION(r118555): Assertion failure in
JSC::DFG::AssemblyHelpers::decodedCodeMapFor on MathJax v2.0 sample
https://bugs.webkit.org/show_bug.cgi?id=90728

Attachment 165632: a simple fix
https://bugs.webkit.org/attachment.cgi?id=165632&action=review

------- Additional Comments from Filip Pizlo <fpizlo at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=165632&action=review


> Source/JavaScriptCore/jit/JIT.cpp:-764
> -    if (canBeOptimized()
> -#if ENABLE(LLINT)
> -	   || true
> -#endif
> -	   ) {

I think the problem here is that we should be emitting a code map when
m_codeBlock->canCompileWithDFG() returns anything other than CannotCompile,
whereas now we're just emitting the map when it returns CanCompile.  This will
happen since the other return value (ShouldProfile) indicates that the DFG may
choose to inline the code block even if it doesn't compile it directly, and
inlined code blocks better have jitCodeMaps.

Could you do this more thorough fix instead?