Current implementation of revertJumpReplacementToBranchPtrWithPatch is wrong in the sh4 MacroAssembler part, leading to random unstabilities with this architecture. I'll submit a patch soon to fix this.
Created attachment 217150 [details] Fix revertJumpReplacementToBranchPtrWithPatch implementation in MacroAssembler for sh4.
Comment on attachment 217150 [details] Fix revertJumpReplacementToBranchPtrWithPatch implementation in MacroAssembler for sh4. View in context: https://bugs.webkit.org/attachment.cgi?id=217150&action=review > Source/JavaScriptCore/ChangeLog:9 > + the sh4 MacroAssembler part, leading to random unstabilities. This patch fixes it I think you mean "instabilities".
(In reply to comment #2) > I think you mean "instabilities". Indeed :)
Created attachment 217170 [details] Fix revertJumpReplacementToBranchPtrWithPatch implementation in MacroAssembler for sh4 (2).
Comment on attachment 217170 [details] Fix revertJumpReplacementToBranchPtrWithPatch implementation in MacroAssembler for sh4 (2). Clearing flags on attachment: 217170 Committed r159400: <http://trac.webkit.org/changeset/159400>
All reviewed patches have been landed. Closing bug.