[Webkit-unassigned] [Bug 147154] Fixed VM pool allocation should have a reserve for allocations that cannot fail

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=147154

--- Comment #1 from Filip Pizlo <fpizlo at apple.com> ---
Currently, if I run with a JIT pool that is artificially limited to 50KB, I get these failures due to crashes when we try to allocate things for which there is no fallback:

stress/lexical-let-loop-semantics.js.ftl-no-cjit-small-pool
stress/lexical-let-semantics.js.ftl-no-cjit-small-pool
stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-no-cjit-small-pool
stress/math-clz32-basics.js.ftl-no-cjit-small-pool
stress/multi-put-by-offset-multiple-transitions.js.ftl-no-cjit-small-pool
stress/multi-put-by-offset-reallocation-butterfly-cse.js.ftl-no-cjit-small-pool
stress/multi-put-by-offset-reallocation-cases.js.ftl-no-cjit-small-pool
stress/throw-from-ftl-call-ic-slow-path-cells.js.ftl-no-cjit-small-pool
stress/throw-from-ftl-call-ic-slow-path.js.ftl-no-cjit-small-pool
stress/type-of-functions-and-objects.js.ftl-no-cjit-small-pool
stress/typed-array-get-by-val-profiling.js.ftl-no-cjit-small-pool
stress/typed-array-put-by-val-profiling.js.ftl-no-cjit-small-pool
regress/script-tests/deltablue-varargs.js.ftl-no-cjit-small-pool
regress/script-tests/emscripten-cube2hash.js.ftl-no-cjit-small-pool
regress/script-tests/inlined-put-by-id-transition.js.ftl-no-cjit-small-pool
regress/script-tests/sorting-benchmark.js.ftl-no-cjit-small-pool
sunspider-1.0/date-format-tofte.js.ftl-no-cjit-small-pool
v8-v6/v8-crypto.js.ftl-no-cjit-small-pool
v8-v6/v8-deltablue.js.ftl-no-cjit-small-pool
v8-v6/v8-earley-boyer.js.ftl-no-cjit-small-pool
v8-v6/v8-raytrace.js.ftl-no-cjit-small-pool
v8-v6/v8-regexp.js.ftl-no-cjit-small-pool
v8-v6/v8-richards.js.ftl-no-cjit-small-pool
v8-v6/v8-splay.js.ftl-no-cjit-small-pool
stress/const-loop-semantics.js.ftl-no-cjit-small-pool
stress/const-tdz.js.ftl-no-cjit-small-pool
stress/constant-folding-osr-exit.js.ftl-no-cjit-small-pool
stress/flatten-oversize-dictionary-object.js.ftl-no-cjit-small-pool
stress/for-in-tests.js.ftl-no-cjit-small-pool

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150721/2e7c07fb/attachment.html>