Bug 68189 - DFG speculative JIT sometimes asserts that a value is not a number even when it doesn't know anything about the number
Summary: DFG speculative JIT sometimes asserts that a value is not a number even when ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-09-15 14:09 PDT by Filip Pizlo
Modified: 2011-09-15 14:53 PDT (History)
4 users (show)

See Also:


Attachments
the patch (2.15 KB, patch)
2011-09-15 14:12 PDT, Filip Pizlo
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-09-15 14:09:09 PDT
The DFG speculative JIT makes use of the isKnownNotNumber() method, which returns true if the GenerationInfo reports that the value is neither an integer nor a double.  But that means that it will return true if the GenerationInfo is either DataFormatNone or DataFormatJS, which means that we actually know nothing about the value.  This results in poor speculations on ValueAdd in release builds, and assertion falues in debug builds.
Comment 1 Filip Pizlo 2011-09-15 14:12:36 PDT
Created attachment 107550 [details]
the patch
Comment 2 Filip Pizlo 2011-09-15 14:53:44 PDT
Landed in r95233.