[Webkit-unassigned] [Bug 108938] New: Assertion failed with DFG JIT on ARM traditional.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=108938

           Summary: Assertion failed with DFG JIT on ARM traditional.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: zherczeg at webkit.org
                CC: barraclough at apple.com, rgabor at webkit.org,
                    fpizlo at apple.com


There is an assertion fail: "ASSERTION FAILED: !m_used[i] || m_used[i] == max() in DFGScoreBoard.h(70) : void JSC::DFG::ScoreBoard::assertClear()" because of a speculated integer division on traditional ARMv7. Reason: a virtual register is referenced 4 times, but only two are found by the ScoreBoard.

Test.js:

function test() {
    return Math.floor( 16 / Math.pow(16,1) );
}

for(var i=0; i<100; i++) {
    test();
}

I suspect the following code is the reason:

DFGFixupPhase.cpp

  case ArithDiv: {
     if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())
         && node->canSpeculateInteger()) {
     }

I saw there is a new optimization using the division supported by CortexA15, but what about old ARMs, which does not have this instruction? Any idea?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.