|Summary:||DFG speculative JIT may crash when speculating int on a non-int JSConstant|
|Product:||WebKit||Reporter:||Filip Pizlo <fpizlo>|
|Version:||528+ (Nightly build)|
Description Filip Pizlo 2011-07-06 12:55:33 PDT
The DFG speculative JIT may sometimes perform speculations that are statically wrong. This is inevitable in the current design and is supposed to be both performance neutral in the average and correct, because the JIT will recover once it detects that the speculation was wrong. However, the JIT fails to perform the recovery in the case that a JSConstant node that references a non-int (for example a JSCell*) is speculated to be an Int32. This causes crashes if the GPR that would have contained the Int32 is ever spilled and filled. The spilling code skips spilling under the assumption that the Int32 can be rematerialized, and the filling code crashes because it's not possible to rematerialize something that is not actually an Int32 constant.
Comment 2 Gavin Barraclough 2011-07-06 13:00:52 PDT
Comment on attachment 99863 [details] the patch At some point we should remove that resolved FIXME you found, too.
Comment 3 Filip Pizlo 2011-07-06 13:08:24 PDT
(In reply to comment #2) > (From update of attachment 99863 [details]) > At some point we should remove that resolved FIXME you found, too. Yup, see https://bugs.webkit.org/show_bug.cgi?id=64022
Comment 4 WebKit Review Bot 2011-07-06 13:40:34 PDT
Comment on attachment 99863 [details] the patch Clearing flags on attachment: 99863 Committed r90487: <http://trac.webkit.org/changeset/90487>
Comment 5 WebKit Review Bot 2011-07-06 13:40:37 PDT
All reviewed patches have been landed. Closing bug.