[Webkit-unassigned] [Bug 90728] REGRESSION(r118555): Assertion failure in JSC::DFG::AssemblyHelpers::decodedCodeMapFor on MathJax v2.0 sample

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=90728


Filip Pizlo <fpizlo at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #165632|review?                     |review-
               Flag|                            |




--- Comment #7 from Filip Pizlo <fpizlo at apple.com>  2012-12-17 15:37:23 PST ---
(From update of attachment 165632)
View in context: https://bugs.webkit.org/attachment.cgi?id=165632&action=review

> Source/JavaScriptCore/jit/JIT.cpp:-764
> -    if (canBeOptimized()
> -#if ENABLE(LLINT)
> -        || true
> -#endif
> -        ) {

I think the problem here is that we should be emitting a code map when m_codeBlock->canCompileWithDFG() returns anything other than CannotCompile, whereas now we're just emitting the map when it returns CanCompile.  This will happen since the other return value (ShouldProfile) indicates that the DFG may choose to inline the code block even if it doesn't compile it directly, and inlined code blocks better have jitCodeMaps.

Could you do this more thorough fix instead?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.