Bug 143535

Summary: JSArray::sortNumeric should handle ArrayWithUndecided
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, benjamin, bfulgham, ggaren, mark.lam, mhahnenb, mmirman, msaboff, nrotem, oliver, ossy, saam, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on: 143582    
Bug Blocks:    
Attachments:
Description Flags
the patch ggaren: review+

Filip Pizlo
Reported 2015-04-08 14:02:31 PDT
Patch forthcoming.
Attachments
the patch (7.87 KB, patch)
2015-04-08 14:03 PDT, Filip Pizlo 		ggaren: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2015-04-08 14:03:59 PDT
Created attachment 250382 [details] the patch
Geoffrey Garen
Comment 2 2015-04-08 14:08:05 PDT
Comment on attachment 250382 [details] the patch r=me
Filip Pizlo
Comment 3 2015-04-08 14:15:24 PDT
Landed in http://trac.webkit.org/changeset/182567
Brent Fulgham
Comment 4 2015-04-09 08:42:06 PDT
This change introduced two Windows failures: ** The following JSC stress test failures have been introduced: regress/script-tests/sorting-benchmark.js.dfg-eager regress/script-tests/sorting-benchmark.js.dfg-eager-no-cjit-validate Can you please resolve?
Csaba Osztrogonác
Comment 5 2015-04-09 09:59:37 PDT
(In reply to comment #4) > This change introduced two Windows failures: > > ** The following JSC stress test failures have been introduced: > regress/script-tests/sorting-benchmark.js.dfg-eager > regress/script-tests/sorting-benchmark.js.dfg-eager-no-cjit-validate > > Can you please resolve? These tests assert on the Apple Mac 32 bit debug bots too.
Csaba Osztrogonác
Comment 6 2015-04-09 10:00:34 PDT
regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: ASSERTION FAILED: (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32 regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: /Volumes/Data/slave/mavericks-32bitJSC-debug/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp(871) : GPRReg JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal(JSC::DFG::Edge, JSC::DataFormat &) [strict = false]
Michael Saboff
Comment 7 2015-04-09 10:12:31 PDT
(In reply to comment #6) > regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: ASSERTION > FAILED: (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32 > regress/script-tests/sorting-benchmark.js.ftl-eager-no-cjit: > /Volumes/Data/slave/mavericks-32bitJSC-debug/build/Source/JavaScriptCore/dfg/ > DFGSpeculativeJIT32_64.cpp(871) : GPRReg > JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal(JSC::DFG::Edge, > JSC::DataFormat &) [strict = false] Looking into these failures.
Note You need to log in before you can comment on or make changes to this bug.