Changeset 215908 in webkit for trunk/Source/JavaScriptCore/b3/testb3.cpp

Timestamp:

Apr 27, 2017, 4:52:41 PM (8 years ago)

Author:

[email protected]

Message:

B3::FoldPathConstants does not consider the fall through case for Switch
​https://bugs.webkit.org/show_bug.cgi?id=171390

Reviewed by Filip Pizlo.

foldPathConstants was not taking into account a Switch's default
case when it tried to constant propagate the switch's operand value.
e.g, we incorrectly transformed this code:

`
x = argumentGPR0;
switch (x) {
case 10: return 20;

case 0:
default: return x == 0;
}
`

into:
`
x = argumentGPR0;
switch (x) {
case 10: return 20;

case 0:
default: return 1;
}
`

Because we didn't take into account the default case, we incorrectly
optimized the code as if case 0's block was only reachable if x is
equal to zero. This is obviously not true, since it's the same block
as the default case.

This fix ensures that we can run the WebAssembly Tanks demo even when
we set webAssemblyBBQOptimizationLevel=2.

• b3/B3FoldPathConstants.cpp:
• b3/B3SwitchValue.cpp:

(JSC::B3::SwitchValue::fallThrough):
(JSC::B3::SwitchValue::removeCase): Deleted.

• b3/B3SwitchValue.h:
• b3/testb3.cpp:

(JSC::B3::testCallFunctionWithHellaArguments):
(JSC::B3::testSwitchSameCaseAsDefault):
(JSC::B3::testWasmBoundsCheck):
(JSC::B3::run):

File:

• trunk/Source/JavaScriptCore/b3/testb3.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/b3/testb3.cpp

@@ -10292 +10292 @@
 void testCallFunctionWithHellaArguments()
 {
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=171392
+    return;
+
     Procedure proc;
     BasicBlock* root = proc.addBlock();
@@ -10747 +10750 @@
     CHECK(!invoke<int32_t>(*code, degree * gap, 42, 11));
     CHECK(!invoke<int32_t>(*code, degree * gap + 1, 42, 11));
+}
+
+void testSwitchSameCaseAsDefault()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    BasicBlock* return10 = proc.addBlock();
+    return10->appendNewControlValue(
+        proc, Return, Origin(),
+        return10->appendNew<Const32Value>(proc, Origin(), 10));
+
+    Value* switchOperand = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+    BasicBlock* caseAndDefault = proc.addBlock();
+    caseAndDefault->appendNewControlValue(
+        proc, Return, Origin(), 
+            caseAndDefault->appendNew<Value>(
+                proc, Equal, Origin(),
+                switchOperand, caseAndDefault->appendNew<ConstPtrValue>(proc, Origin(), 0)));
+
+    SwitchValue* switchValue = root->appendNew<SwitchValue>(proc, Origin(), switchOperand);
+
+    switchValue->appendCase(SwitchCase(100, FrequentedBlock(return10)));
+
+    // Because caseAndDefault is reached both as default case, and when it's 0,
+    // we should not incorrectly optimize and assume that switchOperand==0.
+    switchValue->appendCase(SwitchCase(0, FrequentedBlock(caseAndDefault)));
+    switchValue->setFallThrough(FrequentedBlock(caseAndDefault));
+
+    auto code = compileProc(proc);
+
+    CHECK(invoke<int32_t>(*code, 100) == 10);
+    CHECK(invoke<int32_t>(*code, 0) == 1);
+    CHECK(invoke<int32_t>(*code, 1) == 0);
+    CHECK(invoke<int32_t>(*code, 2) == 0);
+    CHECK(invoke<int32_t>(*code, 99) == 0);
+    CHECK(invoke<int32_t>(*code, 0xbaadbeef) == 0);
 }
 
@@ -15167 +15208 @@
 void testWasmBoundsCheck(unsigned offset)
 {
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=171392
+    return;
+
     Procedure proc;
     GPRReg pinned = GPRInfo::argumentGPR1;
@@ -16317 +16361 @@
     RUN(testSwitch(100, 1));
     RUN(testSwitch(100, 100));
+
+    RUN(testSwitchSameCaseAsDefault());
 
     RUN(testSwitchChillDiv(0, 1));