Title: [224349] trunk
- Revision
- 224349
- Author
- [email protected]
- Date
- 2017-11-02 12:17:25 -0700 (Thu, 02 Nov 2017)
Log Message
AI does not correctly model the clobber case of ArithClz32
https://bugs.webkit.org/show_bug.cgi?id=179188
Reviewed by Michael Saboff.
JSTests:
* stress/arith-clz32-effects.js: Added.
(foo):
(valueOf):
Source/_javascript_Core:
The non-Int32 case clobbers the world because it may call valueOf.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (224348 => 224349)
--- trunk/JSTests/ChangeLog 2017-11-02 19:12:05 UTC (rev 224348)
+++ trunk/JSTests/ChangeLog 2017-11-02 19:17:25 UTC (rev 224349)
@@ -1,3 +1,14 @@
+2017-11-02 Filip Pizlo <[email protected]>
+
+ AI does not correctly model the clobber case of ArithClz32
+ https://bugs.webkit.org/show_bug.cgi?id=179188
+
+ Reviewed by Michael Saboff.
+
+ * stress/arith-clz32-effects.js: Added.
+ (foo):
+ (valueOf):
+
2017-11-01 Michael Saboff <[email protected]>
Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
Added: trunk/JSTests/stress/arith-clz32-effects.js (0 => 224349)
--- trunk/JSTests/stress/arith-clz32-effects.js (rev 0)
+++ trunk/JSTests/stress/arith-clz32-effects.js 2017-11-02 19:17:25 UTC (rev 224349)
@@ -0,0 +1,30 @@
+function foo(o, v)
+{
+ var result = o.f;
+ Math.clz32(v);
+ return result + o.f;
+}
+
+noInline(foo);
+
+var o = {f: 42};
+o.g = 43; // Bust the transition watchpoint of {f}.
+
+for (var i = 0; i < 10000; ++i) {
+ var result = foo({f: 42}, "42");
+ if (result != 84)
+ throw "Error: bad result in loop: " + result;
+}
+
+var o = {f: 43};
+var result = foo(o, {
+ valueOf: function()
+ {
+ delete o.f;
+ o.__defineGetter__("f", function() { return 44; });
+ }
+});
+
+if (result != 87)
+ throw "Error: bad result at end: " + result;
+
Modified: trunk/Source/_javascript_Core/ChangeLog (224348 => 224349)
--- trunk/Source/_javascript_Core/ChangeLog 2017-11-02 19:12:05 UTC (rev 224348)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-11-02 19:17:25 UTC (rev 224349)
@@ -1,3 +1,15 @@
+2017-11-02 Filip Pizlo <[email protected]>
+
+ AI does not correctly model the clobber case of ArithClz32
+ https://bugs.webkit.org/show_bug.cgi?id=179188
+
+ Reviewed by Michael Saboff.
+
+ The non-Int32 case clobbers the world because it may call valueOf.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
2017-11-02 Yusuke Suzuki <[email protected]>
Unreviewed, release throw scope
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (224348 => 224349)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2017-11-02 19:12:05 UTC (rev 224348)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2017-11-02 19:17:25 UTC (rev 224349)
@@ -618,6 +618,14 @@
setConstant(node, jsNumber(clz32(value)));
break;
}
+ switch (node->child1().useKind()) {
+ case Int32Use:
+ case KnownInt32Use:
+ break;
+ default:
+ clobberWorld(node->origin.semantic, clobberLimit);
+ break;
+ }
forNode(node).setType(SpecInt32Only);
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
