RESOLVED DUPLICATE of bug 65930 65937
DFG non-speculative JIT misuses the register allocator when generating ValueToInt32 conversions where the input is known to be a double. 
https://bugs.webkit.org/show_bug.cgi?id=65937
Summary DFG non-speculative JIT misuses the register allocator when generating ValueT...
Filip Pizlo
Reported 2011-08-09 13:24:40 PDT
The DFG JIT has an on-the-fly register allocator, which works by having the code generator specify when a value is needed, when it is being used, and when it is not needed anymore. But the DFG non-speculative JIT path for generating ValueToInt32 conversions where the source is a double will first kill a register and then allocate it. Sometimes this works by accident (if there are other uses of the register), but when visiting http://www.skinnytaste.com/2011/06/ricotta-cheese-chocolate-chip-muffins.html, it generates an assertion failure. The DFG non-speculative JIT should really first allocate the register and then kill it rather than the other way around.
Attachments
the patch (1.69 KB, patch)
2011-08-09 13:26 PDT, Filip Pizlo 		oliver: review-
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-08-09 13:26:47 PDT
Created attachment 103389 [details] the patch
Oliver Hunt
Comment 2 2011-08-09 13:27:42 PDT
Comment on attachment 103389 [details] the patch r- actually, you should make a testcase for this.
Geoffrey Garen
Comment 3 2011-08-09 13:33:19 PDT
Is this a dup of bug 65930?
Filip Pizlo
Comment 4 2011-08-09 13:34:04 PDT
(In reply to comment #3) > Is this a dup of bug 65930? Yeah it is - I didn't see the other bug.
Filip Pizlo
Comment 5 2011-08-09 13:34:21 PDT
*** This bug has been marked as a duplicate of bug 65930 ***
Note You need to log in before you can comment on or make changes to this bug.