RESOLVED FIXED 69205
JSVALUE32_64 DFG JIT - unboxed integers and cells in register file must be reboxed before exiting from DFG JIT 
https://bugs.webkit.org/show_bug.cgi?id=69205
Summary JSVALUE32_64 DFG JIT - unboxed integers and cells in register file must be re...
Yuqiang Xian
Reported 2011-09-30 22:49:47 PDT
If there are unboxed integers and cells in register file (e.g. by SetLocal), they must be reboxed before exiting from the speculative DFG JIT execution.
Attachments
the patch (6.63 KB, patch)
2011-09-30 23:06 PDT, Yuqiang Xian 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Yuqiang Xian
Comment 1 2011-09-30 23:06:15 PDT
Created attachment 109397 [details] the patch This scrubs all obvious crashes of DFG32_64 on SunSpider and kraken cases. Also the number of mozilla test failure cases is reduced to 65/1127 if with op_call/op_construct enabled in DFG32_64 (comparing to the 57/1127 if without op_call/op_construct support). - Tested on Linux x86.
Filip Pizlo
Comment 2 2011-09-30 23:08:42 PDT
Comment on attachment 109397 [details] the patch This looks great. I'd r+ if I officially had review privileges. :-)
WebKit Review Bot
Comment 3 2011-10-01 12:20:50 PDT
Comment on attachment 109397 [details] the patch Clearing flags on attachment: 109397 Committed r96458: <http://trac.webkit.org/changeset/96458>
WebKit Review Bot
Comment 4 2011-10-01 12:20:54 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.