Bug 108938 - Assertion failed with DFG JIT on ARM traditional.
Summary: Assertion failed with DFG JIT on ARM traditional.
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks: 108645
  Show dependency treegraph
 
Reported: 2013-02-05 06:43 PST by Zoltan Herczeg
Modified: 2013-06-13 03:13 PDT (History)
5 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Zoltan Herczeg 2013-02-05 06:43:32 PST
There is an assertion fail: "ASSERTION FAILED: !m_used[i] || m_used[i] == max() in DFGScoreBoard.h(70) : void JSC::DFG::ScoreBoard::assertClear()" because of a speculated integer division on traditional ARMv7. Reason: a virtual register is referenced 4 times, but only two are found by the ScoreBoard.

Test.js:

function test() {
    return Math.floor( 16 / Math.pow(16,1) );
}

for(var i=0; i<100; i++) {
    test();
}

I suspect the following code is the reason:

DFGFixupPhase.cpp

  case ArithDiv: {
     if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())
         && node->canSpeculateInteger()) {
     }
 
I saw there is a new optimization using the division supported by CortexA15, but what about old ARMs, which does not have this instruction? Any idea?