[Webkit-unassigned] [Bug 158806] New: Failing baseline JIT compilation of a code block and then trying to compile it from OSR from DFG/FTL will corrupt the CodeBlock

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=158806

            Bug ID: 158806
           Summary: Failing baseline JIT compilation of a code block and
                    then trying to compile it from OSR from DFG/FTL will
                    corrupt the CodeBlock
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: fpizlo at apple.com

As the title says:

1) Inline a LLInt code block into something else in DFG or FTL.
2) Attempt to compile that LLInt code block and fail.  Failed JIT compilations leave cruft in the CodeBlock that we never clean up.
3) OSR exit from the DFG or FTL code block and force compilation of the LLInt code block.  Now we corrupt the CodeBlock.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160615/c2c11f2a/attachment.html>