Bug 157933 - The baseline JIT crashes when compiling "(1,1)/1"
Summary: The baseline JIT crashes when compiling "(1,1)/1"
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords:
: 158000 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-05-19 16:37 PDT by Oliver Hunt
Modified: 2016-05-23 15:45 PDT (History)
12 users (show)

See Also:


Attachments
patch (2.34 KB, patch)
2016-05-23 15:02 PDT, Saam Barati
benjamin: review+
Details | Formatted Diff | Diff
patch for landing (2.51 KB, patch)
2016-05-23 15:15 PDT, Saam Barati
no flags Details | Formatted Diff | Diff
patch for landing (2.51 KB, patch)
2016-05-23 15:16 PDT, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2016-05-19 16:37:45 PDT
Super simple test case:

for(;;)(1,1)/1

It looks (from the back trace) like some places are correctly considering (1,1) as constant, but other places aren't. The net effect is that we assert/emit breakpoint in a case where we think we should have constant folded (or something)

--Oliver
Comment 1 Saam Barati 2016-05-23 15:01:17 PDT
*** Bug 158000 has been marked as a duplicate of this bug. ***
Comment 2 Saam Barati 2016-05-23 15:02:26 PDT
Created attachment 279587 [details]
patch
Comment 3 Saam Barati 2016-05-23 15:15:25 PDT
Created attachment 279588 [details]
patch for landing
Comment 4 Saam Barati 2016-05-23 15:16:21 PDT
Created attachment 279589 [details]
patch for landing
Comment 5 WebKit Commit Bot 2016-05-23 15:45:34 PDT
Comment on attachment 279589 [details]
patch for landing

Clearing flags on attachment: 279589

Committed r201301: <http://trac.webkit.org/changeset/201301>
Comment 6 WebKit Commit Bot 2016-05-23 15:45:39 PDT
All reviewed patches have been landed.  Closing bug.