Log Message
REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error https://bugs.webkit.org/show_bug.cgi?id=87327
Source/_javascript_Core:
Reviewed by Geoffrey Garen.
If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
set containing >=2 elements, you're going to have a bad time.
That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
to save space and speed up convergence. So filtering has no effect in this case, which made
the code think that the abstract value was proving that the structure check was unnecessary.
The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
right thingies for TOP and >=2 elements.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
LayoutTests:
Reviewed by Geoffrey Garen.
* fast/js/dfg-check-two-structures-expected.txt: Added.
* fast/js/dfg-check-two-structures.html: Added.
* fast/js/script-tests/dfg-check-two-structures.js: Added.
(foo):
Modified Paths
- trunk/LayoutTests/ChangeLog
- trunk/Source/_javascript_Core/ChangeLog
- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp
- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp
- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (118475 => 118476)
--- trunk/LayoutTests/ChangeLog 2012-05-25 05:08:36 UTC (rev 118475)
+++ trunk/LayoutTests/ChangeLog 2012-05-25 05:41:03 UTC (rev 118476)
@@ -1,3 +1,15 @@
+2012-05-24 Filip Pizlo <[email protected]>
+
+ REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
+ https://bugs.webkit.org/show_bug.cgi?id=87327
+
+ Reviewed by Geoffrey Garen.
+
+ * fast/js/dfg-check-two-structures-expected.txt: Added.
+ * fast/js/dfg-check-two-structures.html: Added.
+ * fast/js/script-tests/dfg-check-two-structures.js: Added.
+ (foo):
+
2012-05-24 Sudarsana Nagineni <[email protected]>
[EFL] [DRT] Add support for WebKitOfflineWebApplicationCacheEnabled preference
Added: trunk/LayoutTests/fast/js/dfg-check-two-structures-expected.txt (0 => 118476)
--- trunk/LayoutTests/fast/js/dfg-check-two-structures-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-check-two-structures-expected.txt 2012-05-25 05:41:03 UTC (rev 118476)
@@ -0,0 +1,209 @@
+This tests that a polymorphic structure check is actually executed.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 44
+PASS foo(o, o) is 42
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS foo(o, o) is 46
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-check-two-structures.html (0 => 118476)
--- trunk/LayoutTests/fast/js/dfg-check-two-structures.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-check-two-structures.html 2012-05-25 05:41:03 UTC (rev 118476)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/dfg-check-two-structures.js (0 => 118476)
--- trunk/LayoutTests/fast/js/script-tests/dfg-check-two-structures.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-check-two-structures.js 2012-05-25 05:41:03 UTC (rev 118476)
@@ -0,0 +1,32 @@
+description(
+"This tests that a polymorphic structure check is actually executed."
+);
+
+function foo(o, p) {
+ if (o == p)
+ return o.f;
+ else
+ return 75;
+}
+
+var o1 = {f:42, g:43};
+var o2 = {f:44};
+var o3 = {e:45, f:46};
+
+for (var i = 0; i < 200; ++i) {
+ var o;
+ var expected;
+ if (i < 150) {
+ if (i & 1) {
+ o = o1;
+ expected = 42;
+ } else {
+ o = o2;
+ expected = 44;
+ }
+ } else {
+ o = o3;
+ expected = 46;
+ }
+ shouldBe("foo(o, o)", "" + expected);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (118475 => 118476)
--- trunk/Source/_javascript_Core/ChangeLog 2012-05-25 05:08:36 UTC (rev 118475)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-05-25 05:41:03 UTC (rev 118476)
@@ -1,5 +1,28 @@
2012-05-24 Filip Pizlo <[email protected]>
+ REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
+ https://bugs.webkit.org/show_bug.cgi?id=87327
+
+ Reviewed by Geoffrey Garen.
+
+ If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
+ set containing >=2 elements, you're going to have a bad time.
+
+ That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
+ to save space and speed up convergence. So filtering has no effect in this case, which made
+ the code think that the abstract value was proving that the structure check was unnecessary.
+ The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
+ right thingies for TOP and >=2 elements.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::execute):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-24 Filip Pizlo <[email protected]>
+
new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
https://bugs.webkit.org/show_bug.cgi?id=87378
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (118475 => 118476)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-05-25 05:08:36 UTC (rev 118475)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-05-25 05:41:03 UTC (rev 118476)
@@ -1392,11 +1392,12 @@
break;
case CheckStructure: {
- AbstractValue value = forNode(node.child1());
+ // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
+ AbstractValue& value = forNode(node.child1());
+ node.setCanExit(
+ !value.m_structure.isSubsetOf(node.structureSet())
+ || !isCellPrediction(value.m_type));
value.filter(node.structureSet());
- node.setCanExit(value != forNode(node.child1()));
- // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
- forNode(node.child1()) = value;
m_haveStructures = true;
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (118475 => 118476)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-05-25 05:08:36 UTC (rev 118475)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-05-25 05:41:03 UTC (rev 118476)
@@ -3397,9 +3397,9 @@
}
case CheckStructure: {
- AbstractValue value = m_state.forNode(node.child1());
- value.filter(node.structureSet());
- if (value == m_state.forNode(node.child1())) {
+ AbstractValue& value = m_state.forNode(node.child1());
+ if (value.m_structure.isSubsetOf(node.structureSet())
+ && isCellPrediction(value.m_type)) {
noResult(m_compileIndex);
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (118475 => 118476)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-05-25 05:08:36 UTC (rev 118475)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-05-25 05:41:03 UTC (rev 118476)
@@ -3431,9 +3431,9 @@
break;
}
case CheckStructure: {
- AbstractValue value = m_state.forNode(node.child1());
- value.filter(node.structureSet());
- if (value == m_state.forNode(node.child1())) {
+ AbstractValue& value = m_state.forNode(node.child1());
+ if (value.m_structure.isSubsetOf(node.structureSet())
+ && isCellPrediction(value.m_type)) {
noResult(m_compileIndex);
break;
}
_______________________________________________ webkit-changes mailing list [email protected] http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
