The DFG JIT speculation failure code can undo additions - so if we realize that we executed a destructive addition incorrectly, we can revert it. But the code does not work: it performs an addition on the wrong register (it reverses the source and destination) and then fails to rebox the result, if the destructive addition also did implicit unboxing via zero extension.
Correction: the recovery is done in the right order. The bug here is that it does not do reboxing.
Created attachment 106243 [details] the patch
Attachment 106243 [details] did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source..." exit_code: 1 Source/JavaScriptCore/ChangeLog:3: Line contains tab character. [whitespace/tab] [5] Source/JavaScriptCore/ChangeLog:4: Line contains tab character. [whitespace/tab] [5] Source/JavaScriptCore/ChangeLog:5: Line contains tab character. [whitespace/tab] [5] Total errors found: 3 in 2 files If any of these errors are false positives, please file a bug against check-webkit-style.
Comment on attachment 106243 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=106243&action=review > Source/JavaScriptCore/ChangeLog:6 > + Please remove tabs.
Created attachment 106244 [details] the patch - removed tabs
Comment on attachment 106244 [details] the patch - removed tabs Clearing flags on attachment: 106244 Committed r94478: <http://trac.webkit.org/changeset/94478>
All reviewed patches have been landed. Closing bug.
Could this patch have included a regression test?
(In reply to comment #8) > Could this patch have included a regression test? It could have; at the time I wasn't sure if I could even repro it without tiered compilation but now I know I can. A test case is on the way.