Bug 111777

Summary: Crash when updating predictions below JSC::arrayProtoFuncForEach on tuaw.com article
Product: WebKit Reporter: Michael Saboff <msaboff>
Component: JavaScriptCoreAssignee: Michael Saboff <msaboff>
Severity: Normal Keywords: InRadar
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
URL: http://www.tuaw.com/2012/12/29/5-things-i-want-to-see-from-apple-in-2013/
Bug Depends on:    
Bug Blocks: 112380    
Description Flags
Patch fpizlo: review+

Description Michael Saboff 2013-03-07 14:28:59 PST
Investigating this, I've determined that the issue is due to a register allocation in the middle of generating control flow and we are under register pressure causing us to spill on one path in the control flow but not the other two.  This is in SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull() in dfg/DFGSpeculativeJit32_64.cpp.  Inspection shows that the problem also exists in dfg/DFGSpeculativeJit64.cpp.

Patch forth coming.

From <rdar://problem/13185728>.
Comment 1 Michael Saboff 2013-03-07 16:07:51 PST
Created attachment 192101 [details]
Comment 2 Michael Saboff 2013-03-07 16:21:42 PST
Committed r145150: <http://trac.webkit.org/changeset/145150>