[Webkit-unassigned] [Bug 108938] New: Assertion failed with DFG JIT on ARM traditional.

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Feb 5 06:41:26 PST 2013


           Summary: Assertion failed with DFG JIT on ARM traditional.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: zherczeg at webkit.org
                CC: barraclough at apple.com, rgabor at webkit.org,
                    fpizlo at apple.com

There is an assertion fail: "ASSERTION FAILED: !m_used[i] || m_used[i] == max() in DFGScoreBoard.h(70) : void JSC::DFG::ScoreBoard::assertClear()" because of a speculated integer division on traditional ARMv7. Reason: a virtual register is referenced 4 times, but only two are found by the ScoreBoard.


function test() {
    return Math.floor( 16 / Math.pow(16,1) );

for(var i=0; i<100; i++) {

I suspect the following code is the reason:


  case ArithDiv: {
     if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())
         && node->canSpeculateInteger()) {

I saw there is a new optimization using the division supported by CortexA15, but what about old ARMs, which does not have this instruction? Any idea?

Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the webkit-unassigned mailing list