Bug 109491 - Strange bug in DFG OSR in JSC
Summary: Strange bug in DFG OSR in JSC
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
: 108491 (view as bug list)
Depends on:
Blocks: 108645
  Show dependency tree / graph
 
Reported: 2013-02-11 14:28 PST by Gabor Rapcsanyi
Modified: 2013-02-15 03:36 PST (History)
4 users (show)

See Also:

Attachments
test.js (468 bytes, application/javascript)
2013-02-11 14:37 PST, Gabor Rapcsanyi 		no flags Details
the patch (55.87 KB, patch)
2013-02-11 16:18 PST, Filip Pizlo 		mhahnenberg: review+
Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gabor Rapcsanyi 2013-02-11 14:28:56 PST 
Somehow a JS function run twice after the DFG optimization.
Comment 1 Gabor Rapcsanyi 2013-02-11 14:37:12 PST 
Created attachment 187677 [details]
test.js

The test output is when DFG starts to work:
1
--> a
--> b
2
--> c
3
1
--> a
--> b
2
--> c
3
1
--> a
--> b
--> a
--> b
2
--> c
3

The output with DFGDisassembly:
https://gist.github.com/rgabor-szeged/4758227

This problem exists on x86-64 and ARM architectures as well.
Comment 2 Filip Pizlo 2013-02-11 14:46:48 PST 
Fascinating ... I'll try to take a look.
Comment 3 Filip Pizlo 2013-02-11 14:56:15 PST 
Yup, this is a fun bug.  Int32ToDouble was being injected at a SetLocal, without realizing that it should be doing a forward exit.
Comment 4 Filip Pizlo 2013-02-11 16:18:55 PST 
Created attachment 187713 [details]
the patch
Comment 5 Mark Hahnenberg 2013-02-11 16:29:28 PST 
Comment on attachment 187713 [details]
the patch

r=me
Comment 6 Filip Pizlo 2013-02-11 16:31:24 PST 
Landed in http://trac.webkit.org/changeset/142544
Comment 7 Csaba Osztrogonác 2013-02-15 03:36:27 PST 
*** Bug 108491 has been marked as a duplicate of this bug. ***