[Webkit-unassigned] [Bug 90728] REGRESSION(r118555): Assertion failure in JSC::DFG::AssemblyHelpers::decodedCodeMapFor on MathJax v2.0 sample

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=90728





--- Comment #2 from Yong Li <yoli at rim.com>  2012-09-25 08:35:23 PST ---
It seems DFGOSRExitCompiler assumes setJITCodeMap is always called, however when LLINT isn't enabled, and canBeOptimized() = true, the jitCodeMap is left null.

#if ENABLE(DFG_JIT) || ENABLE(LLINT)
    if (canBeOptimized()
#if ENABLE(LLINT)
        || true
#endif
        ) {
        CompactJITCodeMap::Encoder jitCodeMapEncoder;
        for (unsigned bytecodeOffset = 0; bytecodeOffset < m_labels.size();
++bytecodeOffset) {
            if (m_labels[bytecodeOffset].isSet())
                jitCodeMapEncoder.append(bytecodeOffset,
patchBuffer.offsetOf(m_labels[bytecodeOffset]));
        }
        m_codeBlock->setJITCodeMap(jitCodeMapEncoder.finish());
    }

Filip?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.