Title: [238436] trunk
- Revision
- 238436
- Author
- [email protected]
- Date
- 2018-11-21 19:39:54 -0800 (Wed, 21 Nov 2018)
Log Message
Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
https://bugs.webkit.org/show_bug.cgi?id=191895
<rdar://problem/46167406>
Reviewed by Mark Lam.
JSTests:
* stress/known-cell-use-needs-type-check-assertion.js: Added.
(foo):
(bar):
Source/_javascript_Core:
We were asserting that the input edge should have type SpecCell but it should
really be SpecCellCheck since the type filter for KnownCellUse is SpecCellCheck.
This patch cleans up that assertion code by joining a bunch of cases into a
single function call which grabs the type filter for the edge UseKind and
asserts that the incoming edge meets the type filter criteria.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculate):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::speculate):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (238435 => 238436)
--- trunk/JSTests/ChangeLog 2018-11-22 02:57:14 UTC (rev 238435)
+++ trunk/JSTests/ChangeLog 2018-11-22 03:39:54 UTC (rev 238436)
@@ -1,3 +1,15 @@
+2018-11-21 Saam barati <[email protected]>
+
+ Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
+ https://bugs.webkit.org/show_bug.cgi?id=191895
+ <rdar://problem/46167406>
+
+ Reviewed by Mark Lam.
+
+ * stress/known-cell-use-needs-type-check-assertion.js: Added.
+ (foo):
+ (bar):
+
2018-11-21 Mark Lam <[email protected]>
Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
Added: trunk/JSTests/stress/known-cell-use-needs-type-check-assertion.js (0 => 238436)
--- trunk/JSTests/stress/known-cell-use-needs-type-check-assertion.js (rev 0)
+++ trunk/JSTests/stress/known-cell-use-needs-type-check-assertion.js 2018-11-22 03:39:54 UTC (rev 238436)
@@ -0,0 +1,14 @@
+//@ runDefault("--useTypeProfiler=1")
+
+function foo(z) {
+ bar(z);
+}
+function bar(o) {
+ o.x = 0;
+}
+let p = 0;
+let k = {};
+for (var i = 0; i < 100000; ++i) {
+ bar(p);
+ foo(k);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (238435 => 238436)
--- trunk/Source/_javascript_Core/ChangeLog 2018-11-22 02:57:14 UTC (rev 238435)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-11-22 03:39:54 UTC (rev 238436)
@@ -1,3 +1,23 @@
+2018-11-21 Saam barati <[email protected]>
+
+ Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
+ https://bugs.webkit.org/show_bug.cgi?id=191895
+ <rdar://problem/46167406>
+
+ Reviewed by Mark Lam.
+
+ We were asserting that the input edge should have type SpecCell but it should
+ really be SpecCellCheck since the type filter for KnownCellUse is SpecCellCheck.
+
+ This patch cleans up that assertion code by joining a bunch of cases into a
+ single function call which grabs the type filter for the edge UseKind and
+ asserts that the incoming edge meets the type filter criteria.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::speculate):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::speculate):
+
2018-11-21 Yusuke Suzuki <[email protected]>
[JSC] Use ProtoCallFrame::numberOfRegisters instead of raw number `4`
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (238435 => 238436)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2018-11-22 02:57:14 UTC (rev 238435)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2018-11-22 03:39:54 UTC (rev 238436)
@@ -10286,23 +10286,15 @@
switch (edge.useKind()) {
case UntypedUse:
break;
- case KnownInt32Use:
- ASSERT(!needsTypeCheck(edge, SpecInt32Only));
- break;
case DoubleRepUse:
- ASSERT(!needsTypeCheck(edge, SpecFullDouble));
- break;
case Int52RepUse:
- ASSERT(!needsTypeCheck(edge, SpecAnyInt));
- break;
+ case KnownInt32Use:
case KnownCellUse:
- ASSERT(!needsTypeCheck(edge, SpecCell));
- break;
case KnownStringUse:
- ASSERT(!needsTypeCheck(edge, SpecString));
- break;
case KnownPrimitiveUse:
- ASSERT(!needsTypeCheck(edge, SpecHeapTop & ~SpecObject));
+ case KnownOtherUse:
+ case KnownBooleanUse:
+ ASSERT(!m_interpreter.needsTypeCheck(edge));
break;
case Int32Use:
speculateInt32(edge);
@@ -10327,9 +10319,6 @@
case BooleanUse:
speculateBoolean(edge);
break;
- case KnownBooleanUse:
- ASSERT(!needsTypeCheck(edge, SpecBoolean));
- break;
case CellUse:
speculateCell(edge);
break;
@@ -10405,9 +10394,6 @@
case NotCellUse:
speculateNotCell(edge);
break;
- case KnownOtherUse:
- ASSERT(!needsTypeCheck(edge, SpecOther));
- break;
case OtherUse:
speculateOther(edge);
break;
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (238435 => 238436)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2018-11-22 02:57:14 UTC (rev 238435)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2018-11-22 03:39:54 UTC (rev 238436)
@@ -15339,6 +15339,8 @@
case KnownOtherUse:
case DoubleRepUse:
case Int52RepUse:
+ case KnownCellUse:
+ case KnownBooleanUse:
ASSERT(!m_interpreter.needsTypeCheck(edge));
break;
case Int32Use:
@@ -15350,9 +15352,6 @@
case CellOrOtherUse:
speculateCellOrOther(edge);
break;
- case KnownCellUse:
- ASSERT(!m_interpreter.needsTypeCheck(edge));
- break;
case AnyIntUse:
speculateAnyInt(edge);
break;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
