Changeset 215748 in webkit for trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

Timestamp:

Apr 25, 2017, 12:04:47 PM (8 years ago)

Author:

[email protected]

Message:

Local CSE wrongly CSEs array accesses with different result types.
​https://bugs.webkit.org/show_bug.cgi?id=170990
<rdar://problem/31705945>

Reviewed by Saam Barati.

JSTests:

• stress/regress-170990.js: Added.

Source/JavaScriptCore:

The fix is to use different LocationKind enums for the different type of array
result types. This makes the HeapLocation values different based on the result
types, and allows CSE to discern between them.

• dfg/DFGCSEPhase.cpp:
• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGHeapLocation.cpp:

(WTF::printInternal):

• dfg/DFGHeapLocation.h:

(JSC::DFG::indexedPropertyLocForResultType):

File:

• trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp (modified) (5 diffs)

trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

@@ -461 +461 @@
                         Node* base = m_graph.varArgChild(m_node, 0).node();
                         Node* index = m_graph.varArgChild(m_node, 1).node();
+                        LocationKind indexedPropertyLoc = indexedPropertyLocForResultType(m_node->result());
                         
                         ArrayMode mode = m_node->arrayMode();
@@ -468 +469 @@
                                 break;
                             heap = HeapLocation(
-                                IndexedPropertyLoc, IndexedInt32Properties, base, index);
+                                indexedPropertyLoc, IndexedInt32Properties, base, index);
                             break;
                             
@@ -475 +476 @@
                                 break;
                             heap = HeapLocation(
-                                IndexedPropertyLoc, IndexedDoubleProperties, base, index);
+                                indexedPropertyLoc, IndexedDoubleProperties, base, index);
                             break;
                             
@@ -482 +483 @@
                                 break;
                             heap = HeapLocation(
-                                IndexedPropertyLoc, IndexedContiguousProperties, base, index);
+                                indexedPropertyLoc, IndexedContiguousProperties, base, index);
                             break;
                             
@@ -497 +498 @@
                                 break;
                             heap = HeapLocation(
-                                IndexedPropertyLoc, TypedArrayProperties, base, index);
+                                indexedPropertyLoc, TypedArrayProperties, base, index);
                             break;