Bug 187537

Summary:

DFG JIT: compileMathIC produces incorrect machine code

Product:

WebKit

Reporter:

Michael Saboff <msaboff>

Component:

JavaScriptCore

Assignee:

Michael Saboff <msaboff>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

commit-queue, ews-watchlist, keith_miller, mark.lam, saam, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

Description Michael Saboff 2018-07-10 16:02:18 PDT

When handling ArithMult in the DFG in some cases with a constant value, we can end up JITMulGenerator::generateInline() without selecting a register.  This causes JITMulGenerator::generateInline() to generate bad code.

Comment 1 Michael Saboff 2018-07-10 16:02:42 PDT

<rdar://problem/41952158>

Comment 2 Michael Saboff 2018-07-10 16:18:15 PDT

Created attachment 344731 [details]
Patch

Comment 3 Saam Barati 2018-07-10 17:01:06 PDT

Comment on attachment 344731 [details]
Patch

r=me

Comment 4 Saam Barati 2018-07-10 17:01:31 PDT

Comment on attachment 344731 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=344731&action=review

> Source/JavaScriptCore/jit/JITMulGenerator.cpp:54
> +        ASSERT(m_left);
> +        ASSERT(m_right);

Maybe RELEASE_ASSERT?
Maybe we can do this for the other generators as well?

Comment 5 WebKit Commit Bot 2018-07-10 17:35:09 PDT

Comment on attachment 344731 [details]
Patch

Clearing flags on attachment: 344731

Committed r233716: <https://trac.webkit.org/changeset/233716>

Comment 6 WebKit Commit Bot 2018-07-10 17:35:10 PDT

All reviewed patches have been landed.  Closing bug.