Bug 65233 – DFG JIT speculation failure code performs incorrect conversions in the case where two registers need to be swapped

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

The DFG JIT speculation failure code is quite optimized, and quite complicated.  One special case that it detects, and handles in an efficient way, is where the speculative path would have placed node A in register R1 and node B in register R2, whilst the non-speculative path reversed them: node A in R2, B in R1.  Special care must be taken, however, if speculative represents node A (i.e. R1) as an unboxed integer while non-speculative represents node A (i.e. R2) as a boxed integer.  This is where the DFG will currently fail.  Instead of asking if R1 in speculative has a different register format than R2 in non-speculative, it compares the register formats of R1 in speculative with R1 in non-speculative, despite the fact that R1 is associated with different nodes in the two paths.  This may make the speculation failure code miss cases where register formats need to be converted, and in other cases may perform a conversion on the wrong register, thereby causing two register to be corrupt: the one on which an incorrect conversion was performed, and the one on which no conversion was performed.

[Filip Pizlo]

Created attachment 102095 [details]
the patch

Tests still running.  Will change to ? once (if) they succeed.

[WebKit Review Bot]

Comment on attachment 102095 [details]
the patch

Clearing flags on attachment: 102095

Committed r91825: <http://trac.webkit.org/changeset/91825>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.