Assertion failed with DFG JIT on ARM traditional.

• Component: JavaScriptCore
• Status: NEW ---

[Zoltan Herczeg]

There is an assertion fail: "ASSERTION FAILED: !m_used[i] || m_used[i] == max() in DFGScoreBoard.h(70) : void JSC::DFG::ScoreBoard::assertClear()" because of a speculated integer division on traditional ARMv7. Reason: a virtual register is referenced 4 times, but only two are found by the ScoreBoard.

Test.js:

function test() {
    return Math.floor( 16 / Math.pow(16,1) );
}

for(var i=0; i<100; i++) {
    test();
}

I suspect the following code is the reason:

DFGFixupPhase.cpp

  case ArithDiv: {
     if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())
         && node->canSpeculateInteger()) {
     }
 
I saw there is a new optimization using the division supported by CortexA15, but what about old ARMs, which does not have this instruction? Any idea?