[Webkit-unassigned] [Bug 90728] REGRESSION(r118555): Assertion failure in JSC::DFG::AssemblyHelpers::decodedCodeMapFor on MathJax v2.0 sample

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=90728





--- Comment #8 from Yong Li <yoli at rim.com>  2012-12-18 07:22:14 PST ---
> 
> How can canBeOptimized() == true lead to jitCodeMap being null in the above code?

Probably I meant "= false" and it is a typo.

(In reply to comment #7)
> I think the problem here is that we should be emitting a code map when m_codeBlock->canCompileWithDFG() returns anything other than CannotCompile, whereas now we're just emitting the map when it returns CanCompile.  This will happen since the other return value (ShouldProfile) indicates that the DFG may choose to inline the code block even if it doesn't compile it directly, and inlined code blocks better have jitCodeMaps.
> 
> Could you do this more thorough fix instead?

Thanks. I would give a try. But I don't have enough time at the meantime. Also this issue does bite when LLINT is on. So I cannot promise to work on this any time soon.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.