Bug 64017 – DFG speculative JIT may crash when speculating int on a non-int JSConstant

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

The DFG speculative JIT may sometimes perform speculations that are statically wrong.  This is inevitable in the current design and is supposed to be both performance neutral in the average and correct, because the JIT will recover once it detects that the speculation was wrong.  However, the JIT fails to perform the recovery in the case that a JSConstant node that references a non-int (for example a JSCell*) is speculated to be an Int32.  This causes crashes if the GPR that would have contained the Int32 is ever spilled and filled.  The spilling code skips spilling under the assumption that the Int32 can be rematerialized, and the filling code crashes because it's not possible to rematerialize something that is not actually an Int32 constant.

[Filip Pizlo]

Created attachment 99863 [details]
the patch

[Gavin Barraclough]

Comment on attachment 99863 [details]
the patch

At some point we should remove that resolved FIXME you found, too.

[Filip Pizlo]

(In reply to comment #2)
> (From update of attachment 99863 [details])
> At some point we should remove that resolved FIXME you found, too.

Yup, see https://bugs.webkit.org/show_bug.cgi?id=64022

[WebKit Review Bot]

Comment on attachment 99863 [details]
the patch

Clearing flags on attachment: 99863

Committed r90487: <http://trac.webkit.org/changeset/90487>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.