Bug 65233 - DFG JIT speculation failure code performs incorrect conversions in the case where two registers need to be swapped
Summary: DFG JIT speculation failure code performs incorrect conversions in the case w...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-26 22:34 PDT by Filip Pizlo
Modified: 2011-07-27 00:12 PDT (History)
1 user (show)

See Also:


Attachments
the patch (1.96 KB, patch)
2011-07-26 22:40 PDT, Filip Pizlo
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-07-26 22:34:59 PDT
The DFG JIT speculation failure code is quite optimized, and quite complicated.  One special case that it detects, and handles in an efficient way, is where the speculative path would have placed node A in register R1 and node B in register R2, whilst the non-speculative path reversed them: node A in R2, B in R1.  Special care must be taken, however, if speculative represents node A (i.e. R1) as an unboxed integer while non-speculative represents node A (i.e. R2) as a boxed integer.  This is where the DFG will currently fail.  Instead of asking if R1 in speculative has a different register format than R2 in non-speculative, it compares the register formats of R1 in speculative with R1 in non-speculative, despite the fact that R1 is associated with different nodes in the two paths.  This may make the speculation failure code miss cases where register formats need to be converted, and in other cases may perform a conversion on the wrong register, thereby causing two register to be corrupt: the one on which an incorrect conversion was performed, and the one on which no conversion was performed.
Comment 1 Filip Pizlo 2011-07-26 22:40:09 PDT
Created attachment 102095 [details]
the patch

Tests still running.  Will change to ? once (if) they succeed.
Comment 2 WebKit Review Bot 2011-07-27 00:12:51 PDT
Comment on attachment 102095 [details]
the patch

Clearing flags on attachment: 102095

Committed r91825: <http://trac.webkit.org/changeset/91825>
Comment 3 WebKit Review Bot 2011-07-27 00:12:55 PDT
All reviewed patches have been landed.  Closing bug.