Bug 65937

Summary:

DFG non-speculative JIT misuses the register allocator when generating ValueToInt32 conversions where the input is known to be a double.

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED DUPLICATE

Severity:

Normal

CC:

barraclough, fpizlo, ggaren, oliver

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review-

Filip Pizlo

Reported 2011-08-09 13:24:40 PDT

The DFG JIT has an on-the-fly register allocator, which works by having the code generator specify when a value is needed, when it is being used, and when it is not needed anymore. But the DFG non-speculative JIT path for generating ValueToInt32 conversions where the source is a double will first kill a register and then allocate it. Sometimes this works by accident (if there are other uses of the register), but when visiting http://www.skinnytaste.com/2011/06/ricotta-cheese-chocolate-chip-muffins.html, it generates an assertion failure. The DFG non-speculative JIT should really first allocate the register and then kill it rather than the other way around.

Attachments
the patch (1.69 KB, patch) 2011-08-09 13:26 PDT, Filip Pizlo	oliver: review-	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2011-08-09 13:26:47 PDT

Created attachment 103389 [details] the patch

Oliver Hunt

Comment 2 2011-08-09 13:27:42 PDT

Comment on attachment 103389 [details] the patch r- actually, you should make a testcase for this.

Geoffrey Garen

Comment 3 2011-08-09 13:33:19 PDT

Is this a dup of bug 65930?

Filip Pizlo

Comment 4 2011-08-09 13:34:04 PDT

(In reply to comment #3) > Is this a dup of bug 65930? Yeah it is - I didn't see the other bug.

Filip Pizlo

Comment 5 2011-08-09 13:34:21 PDT

*** This bug has been marked as a duplicate of bug 65930 ***

Note You need to log in before you can comment on or make changes to this bug.