[Webkit-unassigned] [Bug 97496] New: JSC: llint ASM should not reference ArrayProfile outside of VALUE_PROFILER check

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=97496

           Summary: JSC: llint ASM should not reference ArrayProfile
                    outside of VALUE_PROFILER check
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: mark.lam at apple.com


When jsc is built with ENABLE_JIT, ENABLE_LLINT, and !ENABLE_DFG_JIT, run-javascript-test is reporting 900+ regressions.  This is due to a crash in the llint where it is expecting to access an ArrayProfile record which has not been allocated.  This access should be guarded by "if VALUE_PROFILER" and hence should not have occurred.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.