[Webkit-unassigned] [Bug 65421] DFG JIT speculation failure pass sometimes forgets to emit code to move certain registers.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=65421





--- Comment #5 from Filip Pizlo <fpizlo at apple.com>  2011-08-01 14:39:30 PST ---
(In reply to comment #4)
> Created an attachment (id=102540)
 --> (https://bugs.webkit.org/attachment.cgi?id=102540&action=review) [details]
> Regression crash log
> 
> I think this patch caused lots of regressions in the layout tests.  When running the layout tests, DumpRenderTree usually crashes in one of two ways--either due to a GC issue or, if the tests are run a second time, a failed assertion at DFG::needDataFormatConversion(JSC::DFG::DataFormat, JSC::DFG::DataFormat) + 96 (DFGGenerationInfo.h:54).  Crash log for the latter case is attached.

Oh yeah, that's a bug. :-)  Oddly it wasn't created by this patch, it was just "revealed" by this patch.  Previous implementations of the code that this patch addresses were totally broken but worked by accident and happened to never hit the part where a register wasn't correctly formatted.  See https://bugs.webkit.org/show_bug.cgi?id=65490

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.