<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>133340</bug_id>
          
          <creation_ts>2014-05-27 23:23:34 -0700</creation_ts>
          <short_desc>Arrayify neglects to inform the clobberizer that it might fire watchpoints</short_desc>
          <delta_ts>2014-05-28 12:42:34 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Filip Pizlo">fpizlo</reporter>
          <assigned_to name="Filip Pizlo">fpizlo</assigned_to>
          <cc>barraclough</cc>
    
    <cc>ggaren</cc>
    
    <cc>mark.lam</cc>
    
    <cc>mhahnenberg</cc>
    
    <cc>msaboff</cc>
    
    <cc>oliver</cc>
    
    <cc>ossy</cc>
    
    <cc>sam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1012145</commentid>
    <comment_count>0</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-05-27 23:23:34 -0700</bug_when>
    <thetext>And the 32-bit LLInt gets array profiles all wrong, which is probably the reason why this only showed up in 32-bit debug, and it also makes testing this in general much harder.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1012146</commentid>
    <comment_count>1</comment_count>
      <attachid>232172</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-05-27 23:24:42 -0700</bug_when>
    <thetext>Created attachment 232172
the patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1012208</commentid>
    <comment_count>2</comment_count>
      <attachid>232172</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2014-05-28 08:05:18 -0700</bug_when>
    <thetext>Comment on attachment 232172
the patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1012261</commentid>
    <comment_count>3</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-05-28 12:01:02 -0700</bug_when>
    <thetext>Landed in http://trac.webkit.org/changeset/169428</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1012268</commentid>
    <comment_count>4</comment_count>
      <attachid>232172</attachid>
    <who name="Csaba Osztrogonác">ossy</who>
    <bug_when>2014-05-28 12:39:18 -0700</bug_when>
    <thetext>Comment on attachment 232172
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=232172&amp;action=review

&gt; Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm:1408
&gt; -    loadp JSCell::m_structureID[t3], t2
&gt; +    loadp t3, t2

It broke the ARM Thumb2 Linux build:
[  4%] Building CXX object Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o
/tmp/ccowkxrW.s: Assembler messages:
/tmp/ccowkxrW.s:3508: Error: cannot represent T32_OFFSET_IMM relocation in this object file format
make[2]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o] Error 1

And it broke the ARM Traditional Linux build:
[  4%] Building CXX object Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o
/tmp/ccJfKxfJ.s: Assembler messages:
/tmp/ccJfKxfJ.s:3449: Error: internal_relocation (type: OFFSET_IMM) not fixed up
make[2]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o] Error 1
make[1]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/all] Error 2

Didn&apos;t you mean move t3, t2 here as the other part of the patch?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1012269</commentid>
    <comment_count>5</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-05-28 12:40:04 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; (From update of attachment 232172 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=232172&amp;action=review
&gt; 
&gt; &gt; Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm:1408
&gt; &gt; -    loadp JSCell::m_structureID[t3], t2
&gt; &gt; +    loadp t3, t2
&gt; 
&gt; It broke the ARM Thumb2 Linux build:
&gt; [  4%] Building CXX object Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o
&gt; /tmp/ccowkxrW.s: Assembler messages:
&gt; /tmp/ccowkxrW.s:3508: Error: cannot represent T32_OFFSET_IMM relocation in this object file format
&gt; make[2]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o] Error 1
&gt; 
&gt; And it broke the ARM Traditional Linux build:
&gt; [  4%] Building CXX object Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o
&gt; /tmp/ccJfKxfJ.s: Assembler messages:
&gt; /tmp/ccJfKxfJ.s:3449: Error: internal_relocation (type: OFFSET_IMM) not fixed up
&gt; make[2]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o] Error 1
&gt; make[1]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/all] Error 2
&gt; 
&gt; Didn&apos;t you mean move t3, t2 here as the other part of the patch?

Yes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1012270</commentid>
    <comment_count>6</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-05-28 12:42:34 -0700</bug_when>
    <thetext>(In reply to comment #5)
&gt; (In reply to comment #4)
&gt; &gt; (From update of attachment 232172 [details] [details])
&gt; &gt; View in context: https://bugs.webkit.org/attachment.cgi?id=232172&amp;action=review
&gt; &gt; 
&gt; &gt; &gt; Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm:1408
&gt; &gt; &gt; -    loadp JSCell::m_structureID[t3], t2
&gt; &gt; &gt; +    loadp t3, t2
&gt; &gt; 
&gt; &gt; It broke the ARM Thumb2 Linux build:
&gt; &gt; [  4%] Building CXX object Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o
&gt; &gt; /tmp/ccowkxrW.s: Assembler messages:
&gt; &gt; /tmp/ccowkxrW.s:3508: Error: cannot represent T32_OFFSET_IMM relocation in this object file format
&gt; &gt; make[2]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o] Error 1
&gt; &gt; 
&gt; &gt; And it broke the ARM Traditional Linux build:
&gt; &gt; [  4%] Building CXX object Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o
&gt; &gt; /tmp/ccJfKxfJ.s: Assembler messages:
&gt; &gt; /tmp/ccJfKxfJ.s:3449: Error: internal_relocation (type: OFFSET_IMM) not fixed up
&gt; &gt; make[2]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/llint/LowLevelInterpreter.cpp.o] Error 1
&gt; &gt; make[1]: *** [Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/all] Error 2
&gt; &gt; 
&gt; &gt; Didn&apos;t you mean move t3, t2 here as the other part of the patch?
&gt; 
&gt; Yes.

Fixed in http://trac.webkit.org/changeset/169431</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>232172</attachid>
            <date>2014-05-27 23:24:42 -0700</date>
            <delta_ts>2014-05-28 12:39:17 -0700</delta_ts>
            <desc>the patch</desc>
            <filename>blah.patch</filename>
            <type>text/plain</type>
            <size>4266</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTY5NDE1KQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIxIEBA
CisyMDE0LTA1LTI3ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
QXJyYXlpZnkgbmVnbGVjdHMgdG8gaW5mb3JtIHRoZSBjbG9iYmVyaXplciB0aGF0IGl0IG1pZ2h0
IGZpcmUgd2F0Y2hwb2ludHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i
dWcuY2dpP2lkPTEzMzM0MAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor
CisgICAgICAgICogZGZnL0RGR0Nsb2JiZXJpemUuaDoKKyAgICAgICAgKEpTQzo6REZHOjpjbG9i
YmVyaXplKTogQmUgaG9uZXN0LgorICAgICAgICAqIGxsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIz
Ml82NC5hc206IFByb2ZpbGUgdGhlIG9iamVjdCwgbm90IGl0cyBzdHJ1Y3R1cmUuCisgICAgICAg
ICogdGVzdHMvc3RyZXNzL2FycmF5aWZ5LWZpcmVzLXdhdGNocG9pbnQuanM6IEFkZGVkLgorICAg
ICAgICAoZm9vKToKKyAgICAgICAgKHRlc3QpOgorICAgICAgICAobWFrZU9iamVjdEFycmF5KToK
KyAgICAgICAgKiB0ZXN0cy9zdHJlc3MvYXJyYXlpZnktc3RydWN0dXJlLWJhZC10ZXN0LmpzOiBB
ZGRlZC4KKyAgICAgICAgKGZvbyk6CisgICAgICAgICh0ZXN0KToKKwogMjAxNC0wNS0yNyAgSm9u
IExlZSAgPGpvbmxlZUBhcHBsZS5jb20+CiAKICAgICAgICAgVXBkYXRlIEVOQUJMRShNRURJQV9T
T1VSQ0UpIG9uIE1hYwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdDbG9iYmVy
aXplLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdDbG9iYmVy
aXplLmgJKHJldmlzaW9uIDE2OTM1NCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZH
Q2xvYmJlcml6ZS5oCSh3b3JraW5nIGNvcHkpCkBAIC00NjUsNiArNDY1LDcgQEAgdm9pZCBjbG9i
YmVyaXplKEdyYXBoJiBncmFwaCwgTm9kZSogbm9kZQogICAgICAgICB3cml0ZShKU0NlbGxfc3Ry
dWN0dXJlSUQpOwogICAgICAgICB3cml0ZShKU0NlbGxfaW5kZXhpbmdUeXBlKTsKICAgICAgICAg
d3JpdGUoSlNPYmplY3RfYnV0dGVyZmx5KTsKKyAgICAgICAgd3JpdGUoV2F0Y2hwb2ludF9maXJl
KTsKICAgICAgICAgY2xvYmJlcml6ZUZvckFsbG9jYXRpb24ocmVhZCwgd3JpdGUpOwogICAgICAg
ICByZXR1cm47CiAgICAgICAgIApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xv
d0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc20KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3Jp
cHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc20JKHJldmlzaW9uIDE2OTM1
MykKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJf
NjQuYXNtCSh3b3JraW5nIGNvcHkpCkBAIC0xNDA1LDcgKzE0MDUsNyBAQCBfbGxpbnRfb3BfZ2V0
X2FycmF5X2xlbmd0aDoKICAgICBsb2FkaSA4W1BDXSwgdDAKICAgICBsb2FkcCAxNltQQ10sIHQx
CiAgICAgbG9hZENvbnN0YW50T3JWYXJpYWJsZVBheWxvYWQodDAsIENlbGxUYWcsIHQzLCAub3BH
ZXRBcnJheUxlbmd0aFNsb3cpCi0gICAgbG9hZHAgSlNDZWxsOjptX3N0cnVjdHVyZUlEW3QzXSwg
dDIKKyAgICBsb2FkcCB0MywgdDIKICAgICBhcnJheVByb2ZpbGUodDIsIHQxLCB0MCkKICAgICBi
dGl6IHQyLCBJc0FycmF5LCAub3BHZXRBcnJheUxlbmd0aFNsb3cKICAgICBidGl6IHQyLCBJbmRl
eGluZ1NoYXBlTWFzaywgLm9wR2V0QXJyYXlMZW5ndGhTbG93CkBAIC0xNTM5LDcgKzE1MzksNyBA
QCBfbGxpbnRfb3BfZ2V0X2J5X3ZhbDoKICAgICB0cmFjZUV4ZWN1dGlvbigpCiAgICAgbG9hZGkg
OFtQQ10sIHQyCiAgICAgbG9hZENvbnN0YW50T3JWYXJpYWJsZVBheWxvYWQodDIsIENlbGxUYWcs
IHQwLCAub3BHZXRCeVZhbFNsb3cpCi0gICAgbG9hZHAgSlNDZWxsOjptX3N0cnVjdHVyZUlEW3Qw
XSwgdDIKKyAgICBtb3ZlIHQwLCB0MgogICAgIGxvYWRwIDE2W1BDXSwgdDMKICAgICBhcnJheVBy
b2ZpbGUodDIsIHQzLCB0MSkKICAgICBsb2FkaSAxMltQQ10sIHQzCkBAIC0xNjY1LDcgKzE2NjUs
NyBAQCBtYWNybyBwdXRCeVZhbChob2xlQ2hlY2ssIHNsb3dQYXRoKQogICAgIHdyaXRlQmFycmll
ck9uT3BlcmFuZHMoMSwgMykKICAgICBsb2FkaSA0W1BDXSwgdDAKICAgICBsb2FkQ29uc3RhbnRP
clZhcmlhYmxlUGF5bG9hZCh0MCwgQ2VsbFRhZywgdDEsIC5vcFB1dEJ5VmFsU2xvdykKLSAgICBs
b2FkcCBKU0NlbGw6Om1fc3RydWN0dXJlSURbdDFdLCB0MgorICAgIG1vdmUgdDEsIHQyCiAgICAg
bG9hZHAgMTZbUENdLCB0MwogICAgIGFycmF5UHJvZmlsZSh0MiwgdDMsIHQwKQogICAgIGxvYWRp
IDhbUENdLCB0MApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9hcnJh
eWlmeS1maXJlcy13YXRjaHBvaW50LmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0
Q29yZS90ZXN0cy9zdHJlc3MvYXJyYXlpZnktZmlyZXMtd2F0Y2hwb2ludC5qcwkocmV2aXNpb24g
MCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvYXJyYXlpZnktZmlyZXMt
d2F0Y2hwb2ludC5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDI4IEBACitmdW5jdGlvbiBm
b28oYSwgYikgeworICAgIHZhciB4ID0gYi5mOworICAgIHggKz0gYVswXTsKKyAgICByZXR1cm4g
eCArIGIuZjsKK30KKworbm9JbmxpbmUoZm9vKTsKKworZnVuY3Rpb24gdGVzdChhLCBiLCBjKSB7
CisgICAgdmFyIHJlc3VsdCA9IGZvbyhhLCBiKTsKKyAgICBpZiAocmVzdWx0ICE9IGMpCisgICAg
ICAgIHRocm93IG5ldyBFcnJvcigiYmFkIHJlc3VsdDogZXhwZWN0ZWQgIiArIGMgKyAiIGJ1dCBn
b3Q6ICIgKyByZXN1bHQpOworfQorCitmdW5jdGlvbiBtYWtlT2JqZWN0QXJyYXkodmFsdWUpIHsK
KyAgICB2YXIgcmVzdWx0ID0ge307CisgICAgcmVzdWx0WzBdID0gdmFsdWU7CisgICAgcmV0dXJu
IHJlc3VsdDsKK30KKwordmFyIHAgPSB7Zjo0Mn07CitwWzBdID0gNTsKK2ZvciAodmFyIGkgPSAw
OyBpIDwgMTAwMDAwOyArK2kpIHsKKyAgICB0ZXN0KG1ha2VPYmplY3RBcnJheSg0KSwgcCwgODgp
OworICAgIHRlc3QobWFrZU9iamVjdEFycmF5KDQuNSksIHAsIDg4LjUpOworfQorCit0ZXN0KHAs
IHAsIDg5KTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvYXJyYXlp
Znktc3RydWN0dXJlLWJhZC10ZXN0LmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0
Q29yZS90ZXN0cy9zdHJlc3MvYXJyYXlpZnktc3RydWN0dXJlLWJhZC10ZXN0LmpzCShyZXZpc2lv
biAwKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9hcnJheWlmeS1zdHJ1
Y3R1cmUtYmFkLXRlc3QuanMJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwyMiBAQAorZnVuY3Rp
b24gZm9vKGEsIGIpIHsKKyAgICB2YXIgeCA9IGIuZjsKKyAgICB4ICs9IGFbMF07CisgICAgcmV0
dXJuIHggKyBiLmY7Cit9CisKK25vSW5saW5lKGZvbyk7CisKK2Z1bmN0aW9uIHRlc3QoYSwgYiwg
YykgeworICAgIHZhciByZXN1bHQgPSBmb28oYSwgYik7CisgICAgaWYgKHJlc3VsdCAhPSBjKQor
ICAgICAgICB0aHJvdyBuZXcgRXJyb3IoImJhZCByZXN1bHQ6IGV4cGVjdGVkICIgKyBjICsgIiBi
dXQgZ290OiAiICsgcmVzdWx0KTsKK30KKwordmFyIHAgPSB7Zjo0Mn07CitwWzBdID0gNTsKK2Zv
ciAodmFyIGkgPSAwOyBpIDwgMTAwMDAwOyArK2kpIHsKKyAgICB0ZXN0KFs0XSwgcCwgODgpOwor
ICAgIHRlc3QoWzQuNV0sIHAsIDg4LjUpOworfQorCit0ZXN0KHAsIHAsIDg5KTsK
</data>
<flag name="review"
          id="256657"
          type_id="1"
          status="+"
          setter="mark.lam"
    />
          </attachment>
      

    </bug>

</bugzilla>