Bug 69205 - JSVALUE32_64 DFG JIT - unboxed integers and cells in register file must be reboxed before exiting from DFG JIT
Summary: JSVALUE32_64 DFG JIT - unboxed integers and cells in register file must be re...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-09-30 22:49 PDT by Yuqiang Xian
Modified: 2011-10-01 12:20 PDT (History)
3 users (show)

See Also:


Attachments
the patch (6.63 KB, patch)
2011-09-30 23:06 PDT, Yuqiang Xian
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yuqiang Xian 2011-09-30 22:49:47 PDT
If there are unboxed integers and cells in register file (e.g. by SetLocal), they must be reboxed before exiting from the speculative DFG JIT execution.
Comment 1 Yuqiang Xian 2011-09-30 23:06:15 PDT
Created attachment 109397 [details]
the patch

This scrubs all obvious crashes of DFG32_64 on SunSpider and kraken cases. Also the number of mozilla test failure cases is reduced to 65/1127 if with op_call/op_construct enabled in DFG32_64 (comparing to the 57/1127 if without op_call/op_construct support). - Tested on Linux x86.
Comment 2 Filip Pizlo 2011-09-30 23:08:42 PDT
Comment on attachment 109397 [details]
the patch

This looks great.  I'd r+ if I officially had review privileges. :-)
Comment 3 WebKit Review Bot 2011-10-01 12:20:50 PDT
Comment on attachment 109397 [details]
the patch

Clearing flags on attachment: 109397

Committed r96458: <http://trac.webkit.org/changeset/96458>
Comment 4 WebKit Review Bot 2011-10-01 12:20:54 PDT
All reviewed patches have been landed.  Closing bug.