Bug 64017

Summary:

DFG speculative JIT may crash when speculating int on a non-int JSConstant

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

webkit.review.bot

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	none

Description Filip Pizlo 2011-07-06 12:55:33 PDT

The DFG speculative JIT may sometimes perform speculations that are statically wrong.  This is inevitable in the current design and is supposed to be both performance neutral in the average and correct, because the JIT will recover once it detects that the speculation was wrong.  However, the JIT fails to perform the recovery in the case that a JSConstant node that references a non-int (for example a JSCell*) is speculated to be an Int32.  This causes crashes if the GPR that would have contained the Int32 is ever spilled and filled.  The spilling code skips spilling under the assumption that the Int32 can be rematerialized, and the filling code crashes because it's not possible to rematerialize something that is not actually an Int32 constant.

Comment 1 Filip Pizlo 2011-07-06 12:58:17 PDT

Created attachment 99863 [details]
the patch

Comment 2 Gavin Barraclough 2011-07-06 13:00:52 PDT

Comment on attachment 99863 [details]
the patch

At some point we should remove that resolved FIXME you found, too.

Comment 3 Filip Pizlo 2011-07-06 13:08:24 PDT

(In reply to comment #2)
> (From update of attachment 99863 [details])
> At some point we should remove that resolved FIXME you found, too.

Yup, see https://bugs.webkit.org/show_bug.cgi?id=64022

Comment 4 WebKit Review Bot 2011-07-06 13:40:34 PDT

Comment on attachment 99863 [details]
the patch

Clearing flags on attachment: 99863

Committed r90487: <http://trac.webkit.org/changeset/90487>

Comment 5 WebKit Review Bot 2011-07-06 13:40:37 PDT

All reviewed patches have been landed.  Closing bug.