Bug 64017

Summary: DFG speculative JIT may crash when speculating int on a non-int JSConstant
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Severity: Normal CC: webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Description Flags
the patch none

Description Filip Pizlo 2011-07-06 12:55:33 PDT
The DFG speculative JIT may sometimes perform speculations that are statically wrong.  This is inevitable in the current design and is supposed to be both performance neutral in the average and correct, because the JIT will recover once it detects that the speculation was wrong.  However, the JIT fails to perform the recovery in the case that a JSConstant node that references a non-int (for example a JSCell*) is speculated to be an Int32.  This causes crashes if the GPR that would have contained the Int32 is ever spilled and filled.  The spilling code skips spilling under the assumption that the Int32 can be rematerialized, and the filling code crashes because it's not possible to rematerialize something that is not actually an Int32 constant.
Comment 1 Filip Pizlo 2011-07-06 12:58:17 PDT
Created attachment 99863 [details]
the patch
Comment 2 Gavin Barraclough 2011-07-06 13:00:52 PDT
Comment on attachment 99863 [details]
the patch

At some point we should remove that resolved FIXME you found, too.
Comment 3 Filip Pizlo 2011-07-06 13:08:24 PDT
(In reply to comment #2)
> (From update of attachment 99863 [details])
> At some point we should remove that resolved FIXME you found, too.

Yup, see https://bugs.webkit.org/show_bug.cgi?id=64022
Comment 4 WebKit Review Bot 2011-07-06 13:40:34 PDT
Comment on attachment 99863 [details]
the patch

Clearing flags on attachment: 99863

Committed r90487: <http://trac.webkit.org/changeset/90487>
Comment 5 WebKit Review Bot 2011-07-06 13:40:37 PDT
All reviewed patches have been landed.  Closing bug.