Bug 119528 - DFG FixupPhase should insert Int32ToDouble nodes for number uses in NewArray, and SpeculativeJIT 64-bit should not try to coerce integer constants to double constants
Summary: DFG FixupPhase should insert Int32ToDouble nodes for number uses in NewArray,...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2013-08-06 14:51 PDT by Filip Pizlo
Modified: 2013-08-06 21:36 PDT (History)
5 users (show)

See Also:

Attachments
Patch (10.78 KB, patch)
2013-08-06 14:55 PDT, Filip Pizlo 		ggaren: review+
eflews.bot: commit-queue-
Details | Formatted Diff | Diff
Archive of layout-test-results from webkit-ews-05 for mac-mountainlion (507.70 KB, application/zip)
2013-08-06 16:20 PDT, Build Bot 		no flags Details
Archive of layout-test-results from webkit-ews-09 for mac-mountainlion-wk2 (1.20 MB, application/zip)
2013-08-06 16:50 PDT, Build Bot 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-08-06 14:51:03 PDT 
DFG FixupPhase should insert Int32ToDouble nodes for number uses in NewArray, and SpeculativeJIT 64-bit should not try to coerce integer constants to double constants
Comment 1 Filip Pizlo 2013-08-06 14:55:39 PDT 
Created attachment 208219 [details]
Patch
Comment 2 Filip Pizlo 2013-08-06 14:56:41 PDT 
<rdar://problem/14655517>
Comment 3 Geoffrey Garen 2013-08-06 15:00:07 PDT 
Comment on attachment 208219 [details]
Patch

r=me
Comment 4 Mark Hahnenberg 2013-08-06 15:02:51 PDT 
Comment on attachment 208219 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208219&action=review

> Source/JavaScriptCore/dfg/DFGDriver.cpp:-75
> -

Revert!
Comment 5 Mark Hahnenberg 2013-08-06 15:03:22 PDT 
(In reply to comment #4)
> (From update of attachment 208219 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=208219&action=review
> 
> > Source/JavaScriptCore/dfg/DFGDriver.cpp:-75
> > -
> 
> Revert!

Unless it was intentional, of course.
Comment 6 Filip Pizlo 2013-08-06 16:01:15 PDT 
(In reply to comment #5)
> (In reply to comment #4)
> > (From update of attachment 208219 [details] [details])
> > View in context: https://bugs.webkit.org/attachment.cgi?id=208219&action=review
> > 
> > > Source/JavaScriptCore/dfg/DFGDriver.cpp:-75
> > > -
> > 
> > Revert!
> 
> Unless it was intentional, of course.

Yeah, it was intentional :-)  It seems that we got extra whitespace in there from past bisecting hacks.
Comment 7 EFL EWS Bot 2013-08-06 16:15:34 PDT 
Comment on attachment 208219 [details]
Patch

Attachment 208219 [details] did not pass efl-wk2-ews (efl-wk2):
Output: http://webkit-queues.appspot.com/results/1414050
Comment 8 Build Bot 2013-08-06 16:20:48 PDT 
Comment on attachment 208219 [details]
Patch

Attachment 208219 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/1418001

New failing tests:
fast/dom/Window/anonymous-slot-with-changes.html
fast/dom/Window/window-postmessage-clone.html
Comment 9 Build Bot 2013-08-06 16:20:50 PDT 
Created attachment 208223 [details]
Archive of layout-test-results from webkit-ews-05 for mac-mountainlion

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: webkit-ews-05  Port: mac-mountainlion  Platform: Mac OS X 10.8.4
Comment 10 Build Bot 2013-08-06 16:50:22 PDT 
Comment on attachment 208219 [details]
Patch

Attachment 208219 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.appspot.com/results/1370578

New failing tests:
fast/dom/Window/anonymous-slot-with-changes.html
Comment 11 Build Bot 2013-08-06 16:50:24 PDT 
Created attachment 208227 [details]
Archive of layout-test-results from webkit-ews-09 for mac-mountainlion-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: webkit-ews-09  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.4
Comment 12 Filip Pizlo 2013-08-06 19:29:12 PDT 
(In reply to comment #11)
> Created an attachment (id=208227) [details]
> Archive of layout-test-results from webkit-ews-09 for mac-mountainlion-wk2
> 
> The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
> Bot: webkit-ews-09  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.4

This is a real failure: tryGetIndexQuickly is asserting too strongly.  It should assert that in the case of an INT32 array, the result is either JSValue() or int32; but it's asserting that it's an int32.
Comment 13 Filip Pizlo 2013-08-06 20:57:29 PDT 
(In reply to comment #12)
> (In reply to comment #11)
> > Created an attachment (id=208227) [details] [details]
> > Archive of layout-test-results from webkit-ews-09 for mac-mountainlion-wk2
> > 
> > The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
> > Bot: webkit-ews-09  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.4
> 
> This is a real failure: tryGetIndexQuickly is asserting too strongly.  It should assert that in the case of an INT32 array, the result is either JSValue() or int32; but it's asserting that it's an int32.

Yup.  Fixing that assertion also makes everything pass.
Comment 14 Filip Pizlo 2013-08-06 21:36:56 PDT 
Landed in http://trac.webkit.org/changeset/153778