65937 2011-08-09 13:24:40 -0700 DFG non-speculative JIT misuses the register allocator when generating ValueToInt32 conversions where the input is known to be a double. 2011-08-09 13:34:21 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED DUPLICATE 65930 P2 Normal --- 1 fpizlo webkit-unassigned barraclough fpizlo ggaren oliver oldest_to_newest 448753 0 fpizlo 2011-08-09 13:24:40 -0700 The DFG JIT has an on-the-fly register allocator, which works by having the code generator specify when a value is needed, when it is being used, and when it is not needed anymore. But the DFG non-speculative JIT path for generating ValueToInt32 conversions where the source is a double will first kill a register and then allocate it. Sometimes this works by accident (if there are other uses of the register), but when visiting http://www.skinnytaste.com/2011/06/ricotta-cheese-chocolate-chip-muffins.html, it generates an assertion failure. The DFG non-speculative JIT should really first allocate the register and then kill it rather than the other way around. 448756 1 103389 fpizlo 2011-08-09 13:26:47 -0700 Created attachment 103389 the patch 448757 2 103389 oliver 2011-08-09 13:27:42 -0700 Comment on attachment 103389 the patch r- actually, you should make a testcase for this. 448759 3 ggaren 2011-08-09 13:33:19 -0700 Is this a dup of bug 65930? 448761 4 fpizlo 2011-08-09 13:34:04 -0700 (In reply to comment #3) > Is this a dup of bug 65930? Yeah it is - I didn't see the other bug. 448763 5 fpizlo 2011-08-09 13:34:21 -0700 *** This bug has been marked as a duplicate of bug 65930 *** 103389 2011-08-09 13:26:47 -0700 2011-08-09 13:27:42 -0700 the patch useafterfpr_patch_1.diff text/plain 1728 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTI3MDMpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAK KzIwMTEtMDgtMDkgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBE Rkcgbm9uLXNwZWN1bGF0aXZlIEpJVCBtaXN1c2VzIHRoZSByZWdpc3RlciBhbGxvY2F0b3Igd2hl biBnZW5lcmF0aW5nIFZhbHVlVG9JbnQzMgorICAgICAgICBjb252ZXJzaW9ucyB3aGVyZSB0aGUg aW5wdXQgaXMga25vd24gdG8gYmUgYSBkb3VibGUuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD02NTkzNworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgUHV0IHRoZSB1c2UoKSBjYWxsIGFmdGVyIHRo ZSBmcHIoKS9ncHIoKSBjYWxscy4KKworICAgICAgICAqIGRmZy9ERkdOb25TcGVjdWxhdGl2ZUpJ VC5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6Tm9uU3BlY3VsYXRpdmVKSVQ6OmNvbXBpbGUpOgor CiAyMDExLTA4LTA4ICBPbGl2ZXIgSHVudCAgPG9saXZlckBhcHBsZS5jb20+CiAKICAgICAgICAg VXNpbmcgbXByb3RlY3QgdG8gY3JlYXRlIGd1YXJkIHBhZ2VzIGJyZWFrcyBvdXIgdXNlIG9mIG1h ZHZpc2UgdG8gcmVsZWFzZSBleGVjdXRhYmxlIG1lbW9yeQpJbmRleDogU291cmNlL0phdmFTY3Jp cHRDb3JlL2RmZy9ERkdOb25TcGVjdWxhdGl2ZUpJVC5jcHAKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNl L0phdmFTY3JpcHRDb3JlL2RmZy9ERkdOb25TcGVjdWxhdGl2ZUpJVC5jcHAJKHJldmlzaW9uIDky NzAxKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdOb25TcGVjdWxhdGl2ZUpJVC5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTUxMCw5ICs1MTAsMTEgQEAgdm9pZCBOb25TcGVjdWxhdGl2 ZUpJVDo6Y29tcGlsZShTcGVjdWxhdAogICAgICAgICBpZiAoKGNoaWxkSW5mby5yZWdpc3RlckZv cm1hdCgpIHwgRGF0YUZvcm1hdEpTKSA9PSBEYXRhRm9ybWF0SlNEb3VibGUpIHsKICAgICAgICAg ICAgIERvdWJsZU9wZXJhbmQgb3AxKHRoaXMsIG5vZGUuY2hpbGQxKCkpOwogICAgICAgICAgICAg R1BSVGVtcG9yYXJ5IHJlc3VsdCh0aGlzKTsKKyAgICAgICAgICAgIEZQUlJlZyBmcHIgPSBvcDEu ZnByKCk7CisgICAgICAgICAgICBHUFJSZWcgZ3ByID0gcmVzdWx0LmdwcigpOwogICAgICAgICAg ICAgb3AxLnVzZSgpOwotICAgICAgICAgICAgbnVtYmVyVG9JbnQzMihvcDEuZnByKCksIHJlc3Vs dC5ncHIoKSk7Ci0gICAgICAgICAgICBpbnRlZ2VyUmVzdWx0KHJlc3VsdC5ncHIoKSwgbV9jb21w aWxlSW5kZXgsIFVzZUNoaWxkcmVuQ2FsbGVkRXhwbGljaXRseSk7CisgICAgICAgICAgICBudW1i ZXJUb0ludDMyKGZwciwgZ3ByKTsKKyAgICAgICAgICAgIGludGVnZXJSZXN1bHQoZ3ByLCBtX2Nv bXBpbGVJbmRleCwgVXNlQ2hpbGRyZW5DYWxsZWRFeHBsaWNpdGx5KTsKICAgICAgICAgICAgIGJy ZWFrOwogICAgICAgICB9CiAK