Bug 143535

Summary:

JSArray::sortNumeric should handle ArrayWithUndecided

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, benjamin, bfulgham, ggaren, mark.lam, mhahnenb, mmirman, msaboff, nrotem, oliver, ossy, saam, sam

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Bug Depends on:

143582

Bug Blocks:

Attachments:

Description	Flags
the patch	ggaren: review+

Filip Pizlo

Reported 2015-04-08 14:02:31 PDT

Patch forthcoming.

Attachments
the patch (7.87 KB, patch) 2015-04-08 14:03 PDT, Filip Pizlo	ggaren: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2015-04-08 14:03:59 PDT

Created attachment 250382 [details] the patch

Geoffrey Garen

Comment 2 2015-04-08 14:08:05 PDT

Comment on attachment 250382 [details] the patch r=me

Filip Pizlo

Comment 3 2015-04-08 14:15:24 PDT

Landed in http://trac.webkit.org/changeset/182567

Brent Fulgham

Comment 4 2015-04-09 08:42:06 PDT

This change introduced two Windows failures: ** The following JSC stress test failures have been introduced: regress/script-tests/sorting-benchmark.js.dfg-eager regress/script-tests/sorting-benchmark.js.dfg-eager-no-cjit-validate Can you please resolve?

Csaba Osztrogonác

Comment 5 2015-04-09 09:59:37 PDT

(In reply to comment #4) > This change introduced two Windows failures: > > ** The following JSC stress test failures have been introduced: > regress/script-tests/sorting-benchmark.js.dfg-eager > regress/script-tests/sorting-benchmark.js.dfg-eager-no-cjit-validate > > Can you please resolve? These tests assert on the Apple Mac 32 bit debug bots too.

Csaba Osztrogonác

Comment 6 2015-04-09 10:00:34 PDT

regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: ASSERTION FAILED: (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32 regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: /Volumes/Data/slave/mavericks-32bitJSC-debug/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp(871) : GPRReg JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal(JSC::DFG::Edge, JSC::DataFormat &) [strict = false]

Michael Saboff

Comment 7 2015-04-09 10:12:31 PDT

(In reply to comment #6) > regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: ASSERTION > FAILED: (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32 > regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: > /Volumes/Data/slave/mavericks-32bitJSC-debug/build/Source/JavaScriptCore/dfg/ > DFGSpeculativeJIT32_64.cpp(871) : GPRReg > JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal(JSC::DFG::Edge, > JSC::DataFormat &) [strict = false] Looking into these failures.

Note You need to log in before you can comment on or make changes to this bug.