[Webkit-unassigned] [Bug 65421] DFG JIT speculation failure pass sometimes forgets to emit code to move certain registers.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=65421





--- Comment #4 from Mark Hahnenberg <mhahnenberg at apple.com>  2011-08-01 11:51:38 PST ---
Created an attachment (id=102540)
 --> (https://bugs.webkit.org/attachment.cgi?id=102540&action=review)
Regression crash log

I think this patch caused lots of regressions in the layout tests.  When running the layout tests, DumpRenderTree usually crashes in one of two ways--either due to a GC issue or, if the tests are run a second time, a failed assertion at DFG::needDataFormatConversion(JSC::DFG::DataFormat, JSC::DFG::DataFormat) + 96 (DFGGenerationInfo.h:54).  Crash log for the latter case is attached.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.