Changeset 124555 in webkit for trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp

Timestamp:

Aug 2, 2012, 8:27:08 PM (13 years ago)

Author:

[email protected]

Message:

ASSERTION FAILED: at(m_compileIndex).canExit()

m_isCheckingArgumentTypes

​https://bugs.webkit.org/show_bug.cgi?id=91074

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
CFA had proven shouldn't be performed, leading to asserts that a node should not have
exit sites. This is a debug-only assert with no release symptom - we were just emitting
a check that was not reachable.

Also found, and fixed, a bug where structure check hoisting was slightly confusing the
CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
would make the backend happy - but the CFA would produce subtly wrong results.

• bytecode/SpeculatedType.h:

(JSC::isOtherOrEmptySpeculation):
(JSC):

• dfg/DFGDriver.cpp:

(JSC::DFG::compile):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):

LayoutTests:

Added a test for this specific case (dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object)
as well as three other tests to cover similar, though not necessarily currently broken, cases, since it was previously the
case that we apparently had no explicit coverage for these code paths.

• fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object-expected.txt: Added.
• fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html: Added.
• fast/js/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object-expected.txt: Added.
• fast/js/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object.html: Added.
• fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object-expected.txt: Added.
• fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html: Added.
• fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object-expected.txt: Added.
• fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object.html: Added.
• fast/js/script-tests/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.js: Added.

(foo):

• fast/js/script-tests/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object.js: Added.

(foo):

• fast/js/script-tests/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.js: Added.

(foo):

• fast/js/script-tests/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp

@@ -103 +103 @@
         performFixup(dfg);
     }
-    if (performStructureCheckHoisting(dfg))
-        performCFA(dfg); // Need to recompute CFA since nodes were added or changed.
+    bool shouldRedoCFA = performStructureCheckHoisting(dfg);
     performCSE(dfg, FixpointConverged);
+    if (shouldRedoCFA)
+        performCFA(dfg);
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("DFG optimization fixpoint converged in %u iterations.\n", cnt);