64903 2011-07-20 16:40:54 -0700 DFG speculative JIT sometimes claims to use compare operands twice, leading to use count corruption 2011-07-20 17:24:17 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 fpizlo webkit-unassigned barraclough fpizlo webkit.review.bot oldest_to_newest 440109 0 fpizlo 2011-07-20 16:40:54 -0700 The DFG speculative JIT's compare() helper method may call the JITCodeGenerator's non-speculative compare helper, which calls use() on the operands. But then SpeculativeJIT::compare() also calls use() on the operands. The SpeculativeJIT::compare() method should not call use() on the operands if the JITCodeGenerator has already done so. 440111 1 101526 fpizlo 2011-07-20 16:45:11 -0700 Created attachment 101526 the patch 440133 2 101526 webkit.review.bot 2011-07-20 17:24:13 -0700 Comment on attachment 101526 the patch Clearing flags on attachment: 101526 Committed r91428: <http://trac.webkit.org/changeset/91428> 440134 3 webkit.review.bot 2011-07-20 17:24:17 -0700 All reviewed patches have been landed. Closing bug. 101526 2011-07-20 16:45:11 -0700 2011-07-20 17:24:13 -0700 the patch usefix_patch_1.diff text/plain 1851 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTE0MjMpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAK KzIwMTEtMDctMjAgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBE Rkcgc3BlY3VsYXRpdmUgSklUIHNvbWV0aW1lcyBjbGFpbXMgdG8gdXNlIGNvbXBhcmUgb3BlcmFu ZHMgdHdpY2UsIGxlYWRpbmcgdG8KKyAgICAgICAgdXNlIGNvdW50IGNvcnJ1cHRpb24uCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02NDkwMworCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgTW92ZSB0 aGUgY2FsbHMgdG8gdXNlKCkgaW4gU3BlY3VsYXRpdmVKSVQ6OmNvbXBhcmUoKSBzbyB0aGF0IHRo ZXkgb25seSBoYXBwZW4KKyAgICAgICAgaWYgdGhlIEpJVENvZGVHZW5lcmF0b3IncyBoZWxwZXIg bWV0aG9kICh3aGljaCBhbHNvIGNhbGxzIHVzZSgpKSBpcyBub3QgY2FsbGVkLgorCisgICAgICAg ICogZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpTcGVjdWxh dGl2ZUpJVDo6Y29tcGFyZSk6CisKIDIwMTEtMDctMjAgIE9saXZlciBIdW50ICA8b2xpdmVyQGFw cGxlLmNvbT4KIAogICAgICAgICBEb24ndCB0aHJvdyBhd2F5IGNvZGUgd2hlbiBKU0dhcmJhZ2VD b2xsZWN0IEFQSSBpcyBjYWxsZWQKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZH U3BlY3VsYXRpdmVKSVQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9k ZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwCShyZXZpc2lvbiA5MTQxMykKKysrIFNvdXJjZS9KYXZh U2NyaXB0Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0z OTAsMTMgKzM5MCwxMyBAQCBib29sIFNwZWN1bGF0aXZlSklUOjpjb21wYXJlKE5vZGUmIG5vZGUs CiAgICAgICAgIC8vIHNvIGNhbiBiZSBubyBpbnRlcnZlbmluZyBub2RlcyB0byBhbHNvIHJlZmVy ZW5jZSB0aGUgY29tcGFyZS4gCiAgICAgICAgIEFTU0VSVChub2RlLmFkanVzdGVkUmVmQ291bnQo KSA9PSAxKTsKIAotICAgICAgICBpZiAoc2hvdWxkU3BlY3VsYXRlSW50ZWdlcihub2RlLmNoaWxk MSgpLCBub2RlLmNoaWxkMigpKSkKKyAgICAgICAgaWYgKHNob3VsZFNwZWN1bGF0ZUludGVnZXIo bm9kZS5jaGlsZDEoKSwgbm9kZS5jaGlsZDIoKSkpIHsKICAgICAgICAgICAgIGNvbXBpbGVQZWVw SG9sZUludGVnZXJCcmFuY2gobm9kZSwgYnJhbmNoTm9kZUluZGV4LCBjb25kaXRpb24pOwotICAg ICAgICBlbHNlCisgICAgICAgICAgICB1c2Uobm9kZS5jaGlsZDEoKSk7CisgICAgICAgICAgICB1 c2Uobm9kZS5jaGlsZDIoKSk7CisgICAgICAgIH0gZWxzZQogICAgICAgICAgICAgbm9uU3BlY3Vs YXRpdmVQZWVwaG9sZUJyYW5jaChub2RlLCBicmFuY2hOb2RlSW5kZXgsIGNvbmRpdGlvbiwgb3Bl cmF0aW9uKTsKIAotICAgICAgICB1c2Uobm9kZS5jaGlsZDEoKSk7Ci0gICAgICAgIHVzZShub2Rl LmNoaWxkMigpKTsKICAgICAgICAgbV9jb21waWxlSW5kZXggPSBicmFuY2hOb2RlSW5kZXg7CiAg ICAgICAgIHJldHVybiB0cnVlOwogICAgIH0K