[webkit-changes] [122646] trunk

Fri, 13 Jul 2012 16:55:25 -0700

Title: [122646] trunk
Revision
122646
Author
[email protected]
Date
2012-07-13 16:55:18 -0700 (Fri, 13 Jul 2012)

Log Message

ASSERTION FAILED: use.useKind() != DoubleUse
https://bugs.webkit.org/show_bug.cgi?id=91082

Reviewed by Geoffrey Garen.

Source/_javascript_Core: 

The implementation of Branch() was unwisely relying on register allocation state
to decide what speculations to perform. That's never correct.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests: 

* fast/js/dfg-mispredict-variable-but-prove-int-expected.txt: Added.
* fast/js/dfg-mispredict-variable-but-prove-int.html: Added.
* fast/js/script-tests/dfg-mispredict-variable-but-prove-int.js: Added.
(foo):

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (122645 => 122646)


--- trunk/LayoutTests/ChangeLog	2012-07-13 23:39:13 UTC (rev 122645)
+++ trunk/LayoutTests/ChangeLog	2012-07-13 23:55:18 UTC (rev 122646)
@@ -1,3 +1,15 @@
+2012-07-13  Filip Pizlo  <[email protected]>
+
+        ASSERTION FAILED: use.useKind() != DoubleUse
+        https://bugs.webkit.org/show_bug.cgi?id=91082
+
+        Reviewed by Geoffrey Garen.
+
+        * fast/js/dfg-mispredict-variable-but-prove-int-expected.txt: Added.
+        * fast/js/dfg-mispredict-variable-but-prove-int.html: Added.
+        * fast/js/script-tests/dfg-mispredict-variable-but-prove-int.js: Added.
+        (foo):
+
 2012-07-13  Sudarsana Nagineni  <[email protected]>
 
         [EFL] Unskip fast/css/font-face-download-error.html

Added: trunk/LayoutTests/fast/js/dfg-mispredict-variable-but-prove-int-expected.txt (0 => 122646)


--- trunk/LayoutTests/fast/js/dfg-mispredict-variable-but-prove-int-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-mispredict-variable-but-prove-int-expected.txt	2012-07-13 23:55:18 UTC (rev 122646)
@@ -0,0 +1,210 @@
+Tests that a variable predicted to be either int or double but proven to be an int does confuse the Branch logic.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo(0, 1, 0) is 0.5
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS foo(i, i + 1, i + 2) is 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/fast/js/dfg-mispredict-variable-but-prove-int.html (0 => 122646)


--- trunk/LayoutTests/fast/js/dfg-mispredict-variable-but-prove-int.html	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-mispredict-variable-but-prove-int.html	2012-07-13 23:55:18 UTC (rev 122646)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/fast/js/script-tests/dfg-mispredict-variable-but-prove-int.js (0 => 122646)


--- trunk/LayoutTests/fast/js/script-tests/dfg-mispredict-variable-but-prove-int.js	                        (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-mispredict-variable-but-prove-int.js	2012-07-13 23:55:18 UTC (rev 122646)
@@ -0,0 +1,21 @@
+description(
+"Tests that a variable predicted to be either int or double but proven to be an int does confuse the Branch logic."
+);
+
+function foo(a, b, c) {
+    a = b;
+    if (c) {
+        if (a)
+            return 1;
+        else
+            return 2;
+    } else if (b)
+        a = 0.5;
+    return a;
+}
+
+shouldBe("foo(0, 1, 0)", "0.5");
+
+for (var i = 0; i < 200; ++i)
+    shouldBe("foo(i, i + 1, i + 2)", "1");
+

Modified: trunk/Source/_javascript_Core/ChangeLog (122645 => 122646)


--- trunk/Source/_javascript_Core/ChangeLog	2012-07-13 23:39:13 UTC (rev 122645)
+++ trunk/Source/_javascript_Core/ChangeLog	2012-07-13 23:55:18 UTC (rev 122646)
@@ -1,3 +1,18 @@
+2012-07-13  Filip Pizlo  <[email protected]>
+
+        ASSERTION FAILED: use.useKind() != DoubleUse
+        https://bugs.webkit.org/show_bug.cgi?id=91082
+
+        Reviewed by Geoffrey Garen.
+
+        The implementation of Branch() was unwisely relying on register allocation state
+        to decide what speculations to perform. That's never correct.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2012-07-13  Sheriff Bot  <[email protected]>
 
         Unreviewed, rolling out r122640.

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (122645 => 122646)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2012-07-13 23:39:13 UTC (rev 122645)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2012-07-13 23:55:18 UTC (rev 122646)
@@ -2865,7 +2865,7 @@
     }
 
     case Branch:
-        if (isStrictInt32(node.child1().index()) || at(node.child1()).shouldSpeculateInteger()) {
+        if (at(node.child1()).shouldSpeculateInteger()) {
             SpeculateIntegerOperand op(this, node.child1());
             
             BlockIndex taken = node.takenBlockIndex();

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (122645 => 122646)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2012-07-13 23:39:13 UTC (rev 122645)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2012-07-13 23:55:18 UTC (rev 122646)
@@ -2939,7 +2939,7 @@
     }
 
     case Branch:
-        if (isStrictInt32(node.child1().index()) || at(node.child1()).shouldSpeculateInteger()) {
+        if (at(node.child1()).shouldSpeculateInteger()) {
             SpeculateIntegerOperand op(this, node.child1());
             
             BlockIndex taken = node.takenBlockIndex();

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to