WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
46077
ASSERT failure in YARR JIT
https://bugs.webkit.org/show_bug.cgi?id=46077
Summary
ASSERT failure in YARR JIT
Gavin Barraclough
Reported
2010-09-20 00:27:17 PDT
ASSERTION FAILED: to.m_offset != -1 (/Volumes/Data/CopperHead/JavaScriptCore/assembler/X86Assembler.h:1535 void JSC::X86Assembler::linkJump(JSC::X86Assembler::JmpSrc, JSC::X86Assembler::JmpDst)) Segmentation fault: 11 The problem is hit when there are multiple alternatives in the top level disjunction, the last disjunction is longer than the first, and all are BOL predicated, e.g.: /^a|^bc/ Two optimizations are coming into conflict here. Due to the BOL unrolling there is no need to ever loop, so no head of loop label has been set, however the optimized code path that loops without checking length is available (since we have already checked N+1 characters for the last alternative before looping) doesn't check the flag indicating whether a label has been set.
Attachments
The patch
(9.95 KB, patch)
2010-09-20 00:47 PDT
,
Gavin Barraclough
no flags
Details
Formatted Diff
Diff
View All
Add attachment
proposed patch, testcase, etc.
Gavin Barraclough
Comment 1
2010-09-20 00:47:09 PDT
Created
attachment 68056
[details]
The patch
WebKit Commit Bot
Comment 2
2010-09-20 11:31:33 PDT
Comment on
attachment 68056
[details]
The patch Clearing flags on attachment: 68056 Committed
r67867
: <
http://trac.webkit.org/changeset/67867
>
WebKit Commit Bot
Comment 3
2010-09-20 11:31:38 PDT
All reviewed patches have been landed. Closing bug.
Alexey Proskuryakov
Comment 4
2010-09-20 11:46:16 PDT
***
Bug 46075
has been marked as a duplicate of this bug. ***
Alexey Proskuryakov
Comment 5
2011-02-22 13:13:47 PST
***
Bug 46102
has been marked as a duplicate of this bug. ***
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug