Bug 144856 - Creating a new blank document in icloud pages causes an AI error: Abstract value (CellBytecodedoubleBoolOther, TOP, TOP) for double node has type outside SpecFullDouble.
Summary: Creating a new blank document in icloud pages causes an AI error: Abstract va...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on: 144877
Blocks:
  Show dependency treegraph
 
Reported: 2015-05-10 21:20 PDT by Filip Pizlo
Modified: 2015-05-13 16:59 PDT (History)
12 users (show)

See Also:


Attachments
the pagch (9.48 KB, patch)
2015-05-13 16:37 PDT, Filip Pizlo
benjamin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2015-05-10 21:20:14 PDT
Patch forthcoming.
Comment 1 Filip Pizlo 2015-05-13 14:55:12 PDT
It appears that we're converting a GetByVal on a double array to a GetMyArgumentByVal.

I'm going to try to construct a reduced test case.  We probably have two options:

1) Disable sinking on ClonedArguments.  Maybe just disable it if there was some kind of type inference that we can't handle.

2) Make sure that when we convert GetByVal to GetMyArgumentByVal, we respect whatever representation rules there are.
Comment 2 Filip Pizlo 2015-05-13 16:00:47 PDT
And it looks like the culprit is Node::convertToIdentityOn().  It tries to insert conversion nodes, but it fails to apply the right type checks.
Comment 3 Filip Pizlo 2015-05-13 16:30:04 PDT
Reduced case:


function foo() {
    "use strict";
    return arguments[0] + 1.5;
}

noInline(foo);

for (var i = 0; i < 10000; ++i) {
    var result = foo(4.2);
    if (result != 5.7)
        throw "Error: bad result: " + result;
}
Comment 4 Filip Pizlo 2015-05-13 16:37:01 PDT
Created attachment 253073 [details]
the pagch
Comment 5 Filip Pizlo 2015-05-13 16:59:34 PDT
Landed in http://trac.webkit.org/changeset/184318