NEW 108938
Assertion failed with DFG JIT on ARM traditional.
https://bugs.webkit.org/show_bug.cgi?id=108938
Summary Assertion failed with DFG JIT on ARM traditional.
Zoltan Herczeg
Reported 2013-02-05 06:43:32 PST
There is an assertion fail: "ASSERTION FAILED: !m_used[i] || m_used[i] == max() in DFGScoreBoard.h(70) : void JSC::DFG::ScoreBoard::assertClear()" because of a speculated integer division on traditional ARMv7. Reason: a virtual register is referenced 4 times, but only two are found by the ScoreBoard. Test.js: function test() { return Math.floor( 16 / Math.pow(16,1) ); } for(var i=0; i<100; i++) { test(); } I suspect the following code is the reason: DFGFixupPhase.cpp case ArithDiv: { if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node()) && node->canSpeculateInteger()) { } I saw there is a new optimization using the division supported by CortexA15, but what about old ARMs, which does not have this instruction? Any idea?
Attachments
Note You need to log in before you can comment on or make changes to this bug.