Title: [267726] trunk
Revision
267726
Author
[email protected]
Date
2020-09-28 21:54:36 -0700 (Mon, 28 Sep 2020)

Log Message

Add Bounds Check Elimination validation for debugging.
https://bugs.webkit.org/show_bug.cgi?id=217055
rdar://69122891

Reviewed by Keith Miller.

Source/_javascript_Core:

Added a JSC_validateBoundsCheckElimination option (with alias
JSC_validateBCE) that adds an AssertInBounds whenever a CheckInBounds
node is elided.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGIntegerCheckCombiningPhase.cpp:
(JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
* dfg/DFGIntegerRangeOptimizationPhase.cpp:
* dfg/DFGNodeType.h:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValidate.cpp:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileAssertNotEmpty):
(JSC::FTL::DFG::LowerDFGToB3::compileAssertInBounds):
* ftl/FTLOperations.cpp:
(JSC::FTL::operationReportBoundsCheckEliminationErrorAndCrash):
* ftl/FTLOperations.h:
* runtime/OptionsList.h:

Tools:

Added --validateBCE=true to ftl-no-cjit-validate-sampling-profiler
and ftl-eager-no-cjit.

* Scripts/run-jsc-stress-tests:

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (267725 => 267726)


--- trunk/Source/_javascript_Core/ChangeLog	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/ChangeLog	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,3 +1,48 @@
+2020-09-28  Mark Lam  <[email protected]>
+
+        Add Bounds Check Elimination validation for debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=217055
+        rdar://69122891
+
+        Reviewed by Keith Miller.
+
+        Added a JSC_validateBoundsCheckElimination option (with alias
+        JSC_validateBCE) that adds an AssertInBounds whenever a CheckInBounds
+        node is elided.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::validateAIState):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileAssertNotEmpty):
+        (JSC::FTL::DFG::LowerDFGToB3::compileAssertInBounds):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationReportBoundsCheckEliminationErrorAndCrash):
+        * ftl/FTLOperations.h:
+        * runtime/OptionsList.h:
+
 2020-09-26  Yusuke Suzuki  <[email protected]>
 
         Unreviewed, follow-up after r267373 to resolve post-commit review comments

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2020-09-29 04:54:36 UTC (rev 267726)
@@ -4014,6 +4014,9 @@
         break;
     }
 
+    case AssertInBounds:
+        break;
+
     case CheckInBounds: {
         JSValue left = forNode(node->child1()).value();
         JSValue right = forNode(node->child2()).value();

Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h	2020-09-29 04:54:36 UTC (rev 267726)
@@ -457,6 +457,7 @@
         def(PureValue(CheckNotEmpty, AdjacencyList(AdjacencyList::Fixed, node->child1())));
         return;
 
+    case AssertInBounds:
     case AssertNotEmpty:
         write(SideState);
         return;

Modified: trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -182,6 +182,7 @@
     case FencedStoreBarrier:
     case InvalidationPoint:
     case NotifyWrite:
+    case AssertInBounds:
     case CheckInBounds:
     case ConstantStoragePointer:
     case Check:

Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -2118,6 +2118,7 @@
         case CheckTierUpInLoop:
         case CheckTierUpAtReturn:
         case CheckTierUpAndOSREnter:
+        case AssertInBounds:
         case CheckInBounds:
         case ConstantStoragePointer:
         case DoubleAsInt32:

Modified: trunk/Source/_javascript_Core/dfg/DFGIntegerCheckCombiningPhase.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGIntegerCheckCombiningPhase.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGIntegerCheckCombiningPhase.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -282,6 +282,9 @@
                 break;
                 
             case ArrayBounds:
+                ASSERT(node->op() == CheckInBounds);
+                if (UNLIKELY(Options::validateBoundsCheckElimination()))
+                    m_insertionSet.insertNode(nodeIndex, SpecNone, AssertInBounds, node->origin, node->child1(), node->child2());
                 node->convertToIdentityOn(m_map[data.m_key].m_dependency);
                 m_changed = true;
                 break;

Modified: trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -1335,6 +1335,8 @@
                     
                     if (nonNegative && lessThanLength) {
                         executeNode(block->at(nodeIndex));
+                        if (UNLIKELY(Options::validateBoundsCheckElimination()))
+                            m_insertionSet.insertNode(nodeIndex, SpecNone, AssertInBounds, node->origin, node->child1(), node->child2());
                         // We just need to make sure we are a value-producing node.
                         node->convertToIdentityOn(node->child1().node());
                         changed = true;

Modified: trunk/Source/_javascript_Core/dfg/DFGNodeType.h (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGNodeType.h	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGNodeType.h	2020-09-29 04:54:36 UTC (rev 267726)
@@ -280,6 +280,7 @@
     macro(CheckNotEmpty, NodeMustGenerate) \
     macro(AssertNotEmpty, NodeMustGenerate) \
     macro(CheckBadValue, NodeMustGenerate) \
+    macro(AssertInBounds, NodeMustGenerate) \
     macro(CheckInBounds, NodeMustGenerate | NodeResultJS) \
     macro(CheckIdent, NodeMustGenerate) \
     macro(CheckTypeInfoFlags, NodeMustGenerate) /* Takes an OpInfo with the flags you want to test are set */\

Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.h (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGOperations.h	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.h	2020-09-29 04:54:36 UTC (rev 267726)
@@ -330,7 +330,7 @@
 
 void JIT_OPERATION operationProcessTypeProfilerLogDFG(VM*) WTF_INTERNAL;
 
-void JIT_OPERATION operationTriggerReoptimizationNow(CodeBlock* baselineCodeBlock, CodeBlock* optiimzedCodeBlock, OSRExitBase*) WTF_INTERNAL;
+void JIT_OPERATION operationTriggerReoptimizationNow(CodeBlock* baselineCodeBlock, CodeBlock* optimizedCodeBlock, OSRExitBase*) WTF_INTERNAL;
 void triggerReoptimizationNow(CodeBlock* baselineCodeBlock, CodeBlock* optiimzedCodeBlock, OSRExitBase*); // This is not JIT_OPERATION.
 
 #if USE(JSVALUE32_64)

Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -1315,6 +1315,7 @@
         case CheckTierUpInLoop:
         case CheckTierUpAtReturn:
         case CheckTierUpAndOSREnter:
+        case AssertInBounds:
         case CheckInBounds:
         case ValueToInt32:
         case DoubleRep:

Modified: trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -281,6 +281,7 @@
     case StringFromCharCode:
     case ExtractOSREntryLocal:
     case ExtractCatchLocal:
+    case AssertInBounds:
     case CheckInBounds:
     case ConstantStoragePointer:
     case Check:

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -4245,6 +4245,7 @@
     case Int52Rep:
     case FiatInt52:
     case Int52Constant:
+    case AssertInBounds:
     case CheckInBounds:
     case ArithIMul:
     case MultiGetByOffset:

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -5670,6 +5670,7 @@
     case Phi:
     case Upsilon:
     case ExtractOSREntryLocal:
+    case AssertInBounds:
     case CheckInBounds:
     case ArithIMul:
     case MultiGetByOffset:

Modified: trunk/Source/_javascript_Core/dfg/DFGValidate.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/dfg/DFGValidate.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/dfg/DFGValidate.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -638,6 +638,7 @@
                 switch (node->op()) {
                 case Phi:
                 case Upsilon:
+                case AssertInBounds:
                 case CheckInBounds:
                 case PhantomNewObject:
                 case PhantomNewFunction:

Modified: trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -196,6 +196,7 @@
     case ValueToInt32:
     case Branch:
     case LogicalNot:
+    case AssertInBounds:
     case CheckInBounds:
     case ConstantStoragePointer:
     case Check:

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -590,6 +590,8 @@
             if (node->isPhantomAllocation())
                 continue;
 
+            if (node->op() == AssertInBounds)
+                continue;
             if (node->op() == CheckInBounds)
                 continue;
 
@@ -996,6 +998,9 @@
         case GetVectorLength:
             compileGetVectorLength();
             break;
+        case AssertInBounds:
+            compileAssertInBounds();
+            break;
         case CheckInBounds:
             compileCheckInBounds();
             break;
@@ -3713,7 +3718,7 @@
         patchpoint->setGenerator(
             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
                 AllowMacroScratchRegisterUsage allowScratch(jit);
-                GPRReg input =  params[0].gpr();
+                GPRReg input = params[0].gpr();
                 CCallHelpers::Jump done = jit.branchIfNotEmpty(input);
                 jit.breakpoint();
                 done.link(&jit);
@@ -4643,7 +4648,29 @@
             return;
         }
     }
-    
+
+    void compileAssertInBounds()
+    {
+        ASSERT(Options::validateBoundsCheckElimination());
+        LValue index = lowInt32(m_node->child1());
+        LValue bounds = lowInt32(m_node->child2());
+
+        LBasicBlock outOfBoundsCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        m_out.branch(m_out.below(index, bounds), usually(continuation), rarely(outOfBoundsCase));
+
+        LBasicBlock lastNext = m_out.appendTo(outOfBoundsCase, continuation);
+        vmCall(Void, operationReportBoundsCheckEliminationErrorAndCrash,
+            m_out.constIntPtr(bitwise_cast<intptr_t>(codeBlock())),
+            m_out.constInt32(m_node->index()),
+            m_out.constInt32(m_node->child1()->index()),
+            m_out.constInt32(m_node->child2()->index()),
+            index, bounds);
+        m_out.unreachable();
+
+        m_out.appendTo(continuation, lastNext);
+    }
+
     void compileCheckInBounds()
     {
         speculate(

Modified: trunk/Source/_javascript_Core/ftl/FTLOperations.cpp (267725 => 267726)


--- trunk/Source/_javascript_Core/ftl/FTLOperations.cpp	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/ftl/FTLOperations.cpp	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +47,7 @@
 #include "JSMapIterator.h"
 #include "JSSetIterator.h"
 #include "RegExpObject.h"
+#include <wtf/Assertions.h>
 
 IGNORE_WARNINGS_BEGIN("frame-address")
 
@@ -741,6 +742,13 @@
     return lazySlowPath.stub().code().executableAddress();
 }
 
+extern "C" NO_RETURN_DUE_TO_CRASH void JIT_OPERATION operationReportBoundsCheckEliminationErrorAndCrash(intptr_t codeBlockAsIntPtr, int32_t nodeIndex, int32_t child1Index, int32_t child2Index, int32_t checkedIndex, int32_t bounds)
+{
+    CodeBlock* codeBlock = bitwise_cast<CodeBlock*>(codeBlockAsIntPtr);
+    dataLogLn("Bounds Check Eimination error found @ D@", nodeIndex, ": AssertInBounds(index D@", child1Index, ": ", checkedIndex, ", bounds D@", child2Index, " ", bounds, ") in ", codeBlock);
+    CRASH();
+}
+
 } } // namespace JSC::FTL
 
 IGNORE_WARNINGS_END

Modified: trunk/Source/_javascript_Core/ftl/FTLOperations.h (267725 => 267726)


--- trunk/Source/_javascript_Core/ftl/FTLOperations.h	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/ftl/FTLOperations.h	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,6 +45,8 @@
 int32_t JIT_OPERATION operationSwitchStringAndGetBranchOffset(JSGlobalObject*, size_t tableIndex, JSString*) WTF_INTERNAL;
 int32_t JIT_OPERATION operationTypeOfObjectAsTypeofType(JSGlobalObject*, JSCell*) WTF_INTERNAL;
 
+void JIT_OPERATION operationReportBoundsCheckEliminationErrorAndCrash(intptr_t codeBlockAsIntPtr, int32_t, int32_t, int32_t, int32_t, int32_t);
+
 } // extern "C"
 
 } } // namespace JSC::DFG

Modified: trunk/Source/_javascript_Core/runtime/OptionsList.h (267725 => 267726)


--- trunk/Source/_javascript_Core/runtime/OptionsList.h	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Source/_javascript_Core/runtime/OptionsList.h	2020-09-29 04:54:36 UTC (rev 267726)
@@ -384,7 +384,8 @@
     v(Bool, validateExceptionChecks, false, Normal, "Verifies that needed exception checks are performed.") \
     v(Unsigned, unexpectedExceptionStackTraceLimit, 100, Normal, "Stack trace limit for debugging unexpected exceptions observed in the VM") \
     \
-    v(Bool, validateDFGClobberize, false, Normal, "Emits extra validation code in the DFG/FTL for the Clobberize phase")\
+    v(Bool, validateDFGClobberize, false, Normal, "Emits code in the DFG/FTL to validate the Clobberize phase")\
+    v(Bool, validateBoundsCheckElimination, false, Normal, "Emits code in the DFG/FTL to validate bounds check elimination")\
     \
     v(Bool, useExecutableAllocationFuzz, false, Normal, nullptr) \
     v(Unsigned, fireExecutableAllocationFuzzAt, 0, Normal, nullptr) \
@@ -559,7 +560,8 @@
     v(maximumFunctionForClosureCallInlineCandidateInstructionCount, maximumFunctionForClosureCallInlineCandidateBytecodeCost, SameOption) \
     v(maximumFunctionForConstructInlineCandidateInstructionCount, maximumFunctionForConstructInlineCandidateBytecoodeCost, SameOption) \
     v(maximumFTLCandidateInstructionCount, maximumFTLCandidateBytecodeCost, SameOption) \
-    v(maximumInliningCallerSize, maximumInliningCallerBytecodeCost, SameOption)
+    v(maximumInliningCallerSize, maximumInliningCallerBytecodeCost, SameOption) \
+    v(validateBCE, validateBoundsCheckElimination, SameOption)
 
 enum ExperimentalOptionFlags {
     LLIntAndBaselineOnly = 0,

Modified: trunk/Tools/ChangeLog (267725 => 267726)


--- trunk/Tools/ChangeLog	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Tools/ChangeLog	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,3 +1,16 @@
+2020-09-28  Mark Lam  <[email protected]>
+
+        Add Bounds Check Elimination validation for debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=217055
+        rdar://69122891
+
+        Reviewed by Keith Miller.
+
+        Added --validateBCE=true to ftl-no-cjit-validate-sampling-profiler
+        and ftl-eager-no-cjit.
+
+        * Scripts/run-jsc-stress-tests:
+
 2020-09-28  Matt Lewis  <[email protected]>
 
         Fix Build triggers for iOS, watchOS, and tvOS

Modified: trunk/Tools/Scripts/run-jsc-stress-tests (267725 => 267726)


--- trunk/Tools/Scripts/run-jsc-stress-tests	2020-09-29 04:52:54 UTC (rev 267725)
+++ trunk/Tools/Scripts/run-jsc-stress-tests	2020-09-29 04:54:36 UTC (rev 267726)
@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 
-# Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+# Copyright (C) 2013-2020 Apple Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -754,7 +754,7 @@
 end
 
 def runFTLNoCJITValidate(*optionalTestSpecificOptions)
-    run("ftl-no-cjit-validate-sampling-profiler", "--validateGraph=true", "--useSamplingProfiler=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
+    run("ftl-no-cjit-validate-sampling-profiler", "--validateGraph=true", "--validateBCE=true", "--useSamplingProfiler=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
 end
 
 def runFTLNoCJITNoPutStackValidate(*optionalTestSpecificOptions)
@@ -787,7 +787,7 @@
 end
 
 def runFTLEagerNoCJITValidate(*optionalTestSpecificOptions)
-    run("ftl-eager-no-cjit", "--validateGraph=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + FORCE_LLINT_EXIT_OPTIONS + optionalTestSpecificOptions))
+    run("ftl-eager-no-cjit", "--validateGraph=true", "--validateBCE=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + FORCE_LLINT_EXIT_OPTIONS + optionalTestSpecificOptions))
 end
 
 def runFTLEagerNoCJITB3O1(*optionalTestSpecificOptions)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to