WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
NEW
108938
Assertion failed with DFG JIT on ARM traditional.
https://bugs.webkit.org/show_bug.cgi?id=108938
Summary
Assertion failed with DFG JIT on ARM traditional.
Zoltan Herczeg
Reported
2013-02-05 06:43:32 PST
There is an assertion fail: "ASSERTION FAILED: !m_used[i] || m_used[i] == max() in DFGScoreBoard.h(70) : void JSC::DFG::ScoreBoard::assertClear()" because of a speculated integer division on traditional ARMv7. Reason: a virtual register is referenced 4 times, but only two are found by the ScoreBoard. Test.js: function test() { return Math.floor( 16 / Math.pow(16,1) ); } for(var i=0; i<100; i++) { test(); } I suspect the following code is the reason: DFGFixupPhase.cpp case ArithDiv: { if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node()) && node->canSpeculateInteger()) { } I saw there is a new optimization using the division supported by CortexA15, but what about old ARMs, which does not have this instruction? Any idea?
Attachments
Add attachment
proposed patch, testcase, etc.
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug