Bug 65937 - DFG non-speculative JIT misuses the register allocator when generating ValueToInt32 conversions where the input is known to be a double.
Summary: DFG non-speculative JIT misuses the register allocator when generating ValueT...
Status: RESOLVED DUPLICATE of bug 65930
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-09 13:24 PDT by Filip Pizlo
Modified: 2011-08-09 13:34 PDT (History)
4 users (show)

See Also:

Attachments
the patch (1.69 KB, patch)
2011-08-09 13:26 PDT, Filip Pizlo 		oliver: review-
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-08-09 13:24:40 PDT 
The DFG JIT has an on-the-fly register allocator, which works by having the code generator specify when a value is needed, when it is being used, and when it is not needed anymore.  But the DFG non-speculative JIT path for generating ValueToInt32 conversions where the source is a double will first kill a register and then allocate it.  Sometimes this works by accident (if there are other uses of the register), but when visiting http://www.skinnytaste.com/2011/06/ricotta-cheese-chocolate-chip-muffins.html, it generates an assertion failure.  The DFG non-speculative JIT should really first allocate the register and then kill it rather than the other way around.
Comment 1 Filip Pizlo 2011-08-09 13:26:47 PDT 
Created attachment 103389 [details]
the patch
Comment 2 Oliver Hunt 2011-08-09 13:27:42 PDT 
Comment on attachment 103389 [details]
the patch

r- actually, you should make a testcase for this.
Comment 3 Geoffrey Garen 2011-08-09 13:33:19 PDT 
Is this a dup of bug 65930?
Comment 4 Filip Pizlo 2011-08-09 13:34:04 PDT 
(In reply to comment #3)
> Is this a dup of bug 65930?

Yeah it is - I didn't see the other bug.
Comment 5 Filip Pizlo 2011-08-09 13:34:21 PDT 

*** This bug has been marked as a duplicate of bug 65930 ***