RESOLVED FIXED 73286
DFG non-X86 ArithDiv does speculation failure after mutating state, without a value recovery 
https://bugs.webkit.org/show_bug.cgi?id=73286
Summary DFG non-X86 ArithDiv does speculation failure after mutating state, without a...
Filip Pizlo
Reported 2011-11-28 22:30:48 PST
ArithDiv on non-X86 that was speculating integer will perform a double division, attempt to convert to an integer, and then do a speculation failure if the conversion failed. Unfortunately, by the time this speculation check is hit, we have already mutated the registers holding the inputs to the division, which will likely cause the OSR exit code to incorrectly set up the state for the old JIT to reexecute the division.
Attachments
the patch (3.36 KB, patch)
2011-11-28 22:32 PST, Filip Pizlo 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-11-28 22:32:26 PST
Created attachment 116899 [details] the patch
WebKit Review Bot
Comment 2 2011-11-28 23:44:28 PST
Comment on attachment 116899 [details] the patch Clearing flags on attachment: 116899 Committed r101332: <http://trac.webkit.org/changeset/101332>
WebKit Review Bot
Comment 3 2011-11-28 23:44:32 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.