Bug 72486

Summary: REGRESSION (r99754): V8 DeltaBlue test crash
Product: WebKit Reporter: Hikari <hikarikurai>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Normal CC: barraclough, fpizlo, ggaren, mhahnenberg, oliver, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Windows 7   
URL: http://v8.googlecode.com/svn/data/benchmarks/current/run.html
Attachments:
Description Flags
source file none

Hikari
Reported 2011-11-16 04:07:58 PST
// "\Source\JavaScriptCore\jit\JITCode.h" inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData) { JSValue result = JSValue::decode(ctiTrampoline(m_ref.code().executableAddress(), registerFile, callFrame, 0, Profiler::enabledProfilerReference(), globalData)); return globalData->exception ? jsNull() : result; } // "http://v8.googlecode.com/svn/data/benchmarks/current/run.html"
Attachments
source file (25.07 KB, text/html)
2011-11-18 02:02 PST, Hikari 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Hikari
Comment 1 2011-11-18 02:02:02 PST
Created attachment 115769 [details] source file
Hikari
Comment 2 2011-11-18 02:03:06 PST
crash at r99754 or later, but pass at r99753
Alexey Proskuryakov
Comment 3 2011-11-21 16:36:48 PST
*** Bug 72897 has been marked as a duplicate of this bug. ***
Alexey Proskuryakov
Comment 4 2011-11-21 16:38:01 PST
Regressed in <http://trac.webkit.org/changeset/99754> per above comment.
Gavin Barraclough
Comment 5 2012-03-07 17:17:22 PST
Works for me in r110120, please reopen if the bug still repros for you.
Note You need to log in before you can comment on or make changes to this bug.