Bug 68189

Summary: DFG speculative JIT sometimes asserts that a value is not a number even when it doesn't know anything about the number
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, fpizlo, ggaren, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch oliver: review+

Filip Pizlo
Reported 2011-09-15 14:09:09 PDT
The DFG speculative JIT makes use of the isKnownNotNumber() method, which returns true if the GenerationInfo reports that the value is neither an integer nor a double. But that means that it will return true if the GenerationInfo is either DataFormatNone or DataFormatJS, which means that we actually know nothing about the value. This results in poor speculations on ValueAdd in release builds, and assertion falues in debug builds.
Attachments
the patch (2.15 KB, patch)
2011-09-15 14:12 PDT, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-09-15 14:12:36 PDT
Created attachment 107550 [details] the patch
Filip Pizlo
Comment 2 2011-09-15 14:53:44 PDT
Landed in r95233.
Note You need to log in before you can comment on or make changes to this bug.