Bug 143535

Summary:

JSArray::sortNumeric should handle ArrayWithUndecided

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, benjamin, bfulgham, ggaren, mark.lam, mhahnenb, mmirman, msaboff, nrotem, oliver, ossy, saam, sam

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Bug Depends on:

143582

Bug Blocks:

Attachments:

Description	Flags
the patch	ggaren: review+

Description Filip Pizlo 2015-04-08 14:02:31 PDT

Patch forthcoming.

Comment 1 Filip Pizlo 2015-04-08 14:03:59 PDT

Created attachment 250382 [details]
the patch

Comment 2 Geoffrey Garen 2015-04-08 14:08:05 PDT

Comment on attachment 250382 [details]
the patch

r=me

Comment 3 Filip Pizlo 2015-04-08 14:15:24 PDT

Landed in http://trac.webkit.org/changeset/182567

Comment 4 Brent Fulgham 2015-04-09 08:42:06 PDT

This change introduced two Windows failures:

** The following JSC stress test failures have been introduced:
	regress/script-tests/sorting-benchmark.js.dfg-eager
	regress/script-tests/sorting-benchmark.js.dfg-eager-no-cjit-validate

Can you please resolve?

Comment 5 Csaba Osztrogonác 2015-04-09 09:59:37 PDT

(In reply to comment #4)
> This change introduced two Windows failures:
> 
> ** The following JSC stress test failures have been introduced:
> 	regress/script-tests/sorting-benchmark.js.dfg-eager
> 	regress/script-tests/sorting-benchmark.js.dfg-eager-no-cjit-validate
> 
> Can you please resolve?

These tests assert on the Apple Mac 32 bit debug bots too.

Comment 6 Csaba Osztrogonác 2015-04-09 10:00:34 PDT

regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: ASSERTION FAILED: (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32
regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: /Volumes/Data/slave/mavericks-32bitJSC-debug/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp(871) : GPRReg JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal(JSC::DFG::Edge, JSC::DataFormat &) [strict = false]

Comment 7 Michael Saboff 2015-04-09 10:12:31 PDT

(In reply to comment #6)
> regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: ASSERTION
> FAILED: (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32
> regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit:
> /Volumes/Data/slave/mavericks-32bitJSC-debug/build/Source/JavaScriptCore/dfg/
> DFGSpeculativeJIT32_64.cpp(871) : GPRReg
> JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal(JSC::DFG::Edge,
> JSC::DataFormat &) [strict = false]

Looking into these failures.