Bug 118486 - NaturalLoops + Profiler = Crash
Summary: NaturalLoops + Profiler = Crash
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Filip Pizlo
Depends on:
Blocks: 118338
  Show dependency treegraph
Reported: 2013-07-08 15:10 PDT by Mark Hahnenberg
Modified: 2013-07-08 22:09 PDT (History)
1 user (show)

See Also:

the patch (4.38 KB, patch)
2013-07-08 22:03 PDT, Filip Pizlo
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Hahnenberg 2013-07-08 15:10:28 PDT
NaturalLoops::compute uses i instead of j in one of its internal loops. Should be a simple fix.
Comment 1 Mark Hahnenberg 2013-07-08 21:44:57 PDT
Looks like it's more complicated than I thought. Still crashes with this fix.
Comment 2 Filip Pizlo 2013-07-08 21:45:13 PDT
Added https://bugs.webkit.org/show_bug.cgi?id=118338 to the blocks list since SSA conversion needs Dominators and this bug looks like it might be Dominators-related.
Comment 3 Filip Pizlo 2013-07-08 21:58:24 PDT
Yeah I borked dominators.  Lol.  Patch on the way.
Comment 4 Filip Pizlo 2013-07-08 22:00:18 PDT
(In reply to comment #3)
> Yeah I borked dominators.  Lol.  Patch on the way.

See: http://trac.webkit.org/changeset/152431/branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGDominators.h

Notice how I reversed "to" and "from".
Comment 5 Filip Pizlo 2013-07-08 22:03:22 PDT
Created attachment 206289 [details]
the patch
Comment 6 Geoffrey Garen 2013-07-08 22:06:01 PDT
Comment on attachment 206289 [details]
the patch

Comment 7 Filip Pizlo 2013-07-08 22:09:43 PDT
Landed in http://trac.webkit.org/changeset/152481