Bug 64017 - DFG speculative JIT may crash when speculating int on a non-int JSConstant
Summary: DFG speculative JIT may crash when speculating int on a non-int JSConstant
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-06 12:55 PDT by Filip Pizlo
Modified: 2011-07-06 13:40 PDT (History)
1 user (show)

See Also:


Attachments
the patch (1.69 KB, patch)
2011-07-06 12:58 PDT, Filip Pizlo
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-07-06 12:55:33 PDT
The DFG speculative JIT may sometimes perform speculations that are statically wrong.  This is inevitable in the current design and is supposed to be both performance neutral in the average and correct, because the JIT will recover once it detects that the speculation was wrong.  However, the JIT fails to perform the recovery in the case that a JSConstant node that references a non-int (for example a JSCell*) is speculated to be an Int32.  This causes crashes if the GPR that would have contained the Int32 is ever spilled and filled.  The spilling code skips spilling under the assumption that the Int32 can be rematerialized, and the filling code crashes because it's not possible to rematerialize something that is not actually an Int32 constant.
Comment 1 Filip Pizlo 2011-07-06 12:58:17 PDT
Created attachment 99863 [details]
the patch
Comment 2 Gavin Barraclough 2011-07-06 13:00:52 PDT
Comment on attachment 99863 [details]
the patch

At some point we should remove that resolved FIXME you found, too.
Comment 3 Filip Pizlo 2011-07-06 13:08:24 PDT
(In reply to comment #2)
> (From update of attachment 99863 [details])
> At some point we should remove that resolved FIXME you found, too.

Yup, see https://bugs.webkit.org/show_bug.cgi?id=64022
Comment 4 WebKit Review Bot 2011-07-06 13:40:34 PDT
Comment on attachment 99863 [details]
the patch

Clearing flags on attachment: 99863

Committed r90487: <http://trac.webkit.org/changeset/90487>
Comment 5 WebKit Review Bot 2011-07-06 13:40:37 PDT
All reviewed patches have been landed.  Closing bug.