97496 2012-09-24 16:43:29 -0700 JSC: llint ASM should not reference ArrayProfile outside of VALUE_PROFILER check 2012-09-24 16:53:40 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mark.lam mark.lam fpizlo oldest_to_newest 727075 0 mark.lam 2012-09-24 16:43:29 -0700 When jsc is built with ENABLE_JIT, ENABLE_LLINT, and !ENABLE_DFG_JIT, run-javascript-test is reporting 900+ regressions. This is due to a crash in the llint where it is expecting to access an ArrayProfile record which has not been allocated. This access should be guarded by "if VALUE_PROFILER" and hence should not have occurred. 727082 1 165468 mark.lam 2012-09-24 16:50:19 -0700 Created attachment 165468 Fix. Fixed as suggested by Filip. 727083 2 mark.lam 2012-09-24 16:53:40 -0700 Landed in http://trac.webkit.org/changeset/129428. 165468 2012-09-24 16:50:19 -0700 2012-09-24 16:50:58 -0700 Fix. bug-97496.patch text/plain 1986 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI5NDI3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDEyLTA5LTI0ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBB ZGRlZCBhIG1pc3NpbmcgImlmIFZBTFVFX1BST0ZJTEVSIiBhcm91bmQgYW4gYWNjZXNzIHRvIEFy cmF5UHJvZmlsZSByZWNvcmQuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD05NzQ5Ni4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICAqIGxsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc206CisgICAgICAg ICogbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRlcjY0LmFzbToKKwogMjAxMi0wOS0yNCAgR2VvZmZy ZXkgR2FyZW4gIDxnZ2FyZW5AYXBwbGUuY29tPgogCiAgICAgICAgIElubGluZWQgYWN0aXZhdGlv biB0ZWFyLW9mZiBpbiB0aGUgREZHCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvbGxpbnQv TG93TGV2ZWxJbnRlcnByZXRlcjMyXzY0LmFzbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNj cmlwdENvcmUvbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRlcjMyXzY0LmFzbQkocmV2aXNpb24gMTI5 NDI2KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIz Ml82NC5hc20JKHdvcmtpbmcgY29weSkKQEAgLTEzOTgsNyArMTM5OCw5IEBAIF9sbGludF9vcF9w dXRfYnlfdmFsOgogICAgIGRpc3BhdGNoKDUpCiAKIC5vcFB1dEJ5VmFsRW1wdHk6Ci0gICAgc3Rv cmViIDEsIEFycmF5UHJvZmlsZTo6bV9tYXlTdG9yZVRvSG9sZVt0M10KKyAgICBpZiBWQUxVRV9Q Uk9GSUxFUgorICAgICAgICBzdG9yZWIgMSwgQXJyYXlQcm9maWxlOjptX21heVN0b3JlVG9Ib2xl W3QzXQorICAgIGVuZAogICAgIGFkZGkgMSwgQXJyYXlTdG9yYWdlOjptX251bVZhbHVlc0luVmVj dG9yW3QwXQogICAgIGJpYiB0MiwgLXNpemVvZiBJbmRleGluZ0hlYWRlciArIEluZGV4aW5nSGVh ZGVyOjptX3B1YmxpY0xlbmd0aFt0MF0sIC5vcFB1dEJ5VmFsU3RvcmVSZXN1bHQKICAgICBhZGRp IDEsIHQyLCB0MQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50 ZXJwcmV0ZXI2NC5hc20KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50 L0xvd0xldmVsSW50ZXJwcmV0ZXI2NC5hc20JKHJldmlzaW9uIDEyOTQyNikKKysrIFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyNjQuYXNtCSh3b3JraW5nIGNv cHkpCkBAIC0xMjQxLDcgKzEyNDEsOSBAQCBfbGxpbnRfb3BfcHV0X2J5X3ZhbDoKICAgICBkaXNw YXRjaCg1KQogCiAub3BQdXRCeVZhbEVtcHR5OgotICAgIHN0b3JlYiAxLCBBcnJheVByb2ZpbGU6 Om1fbWF5U3RvcmVUb0hvbGVbdDNdCisgICAgaWYgVkFMVUVfUFJPRklMRVIKKyAgICAgICAgc3Rv cmViIDEsIEFycmF5UHJvZmlsZTo6bV9tYXlTdG9yZVRvSG9sZVt0M10KKyAgICBlbmQKICAgICBh ZGRpIDEsIEFycmF5U3RvcmFnZTo6bV9udW1WYWx1ZXNJblZlY3Rvclt0MF0KICAgICBiaWIgdDIs IC1zaXplb2YgSW5kZXhpbmdIZWFkZXIgKyBJbmRleGluZ0hlYWRlcjo6bV9wdWJsaWNMZW5ndGhb dDBdLCAub3BQdXRCeVZhbFN0b3JlUmVzdWx0CiAgICAgYWRkaSAxLCB0MiwgdDEK