Changeset 230488 in webkit for trunk/Source/JavaScriptCore/dfg/DFGClobberSet.cpp

Timestamp:

Apr 10, 2018, 12:45:54 PM (7 years ago)

Author:

[email protected]

Message:

DFG AI and clobberize should agree with each other
​https://bugs.webkit.org/show_bug.cgi?id=184440

Reviewed by Saam Barati.

JSTests:

Add tests for all of the bugs I fixed.

• stress/direct-arguments-out-of-bounds-change-structure.js: Added.

(foo):

• stress/new-typed-array-cse-effects.js: Added.

(foo):

• stress/scoped-arguments-out-of-bounds-change-structure.js: Added.

(foo.theO):
(foo):

• stress/string-from-char-code-change-structure-not-dead.js: Added.

(foo):
(i.valueOf):
(weirdValue.valueOf):

• stress/string-from-char-code-change-structure.js: Added.

(foo):
(i.valueOf):
(weirdValue.valueOf):

Source/JavaScriptCore:

One way to fix bugs involving underapproximation in AI or clobberize is to assert that they
agree with each other. That's what this patch does: it adds an assertion that AI's structure
state tracking must be equivalent to JSCell_structureID being clobbered.

One subtlety is that AI sometimes folds away structure clobbering using information that
clobberize doesn't have. So, we track this wuth special kinds of AI states (FoldedClobber and
ObservedTransitions).

This fixes a bunch of cases of AI missing clobberStructures/clobberWorld and one case of
clobberize missing a write(Heap).

This also makes some cases more precise in order to appease the assertion. Making things more
precise might make things faster, but I didn't measure it because that wasn't the goal.

• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• dfg/DFGAbstractInterpreter.h:
• dfg/DFGAbstractInterpreterClobberState.cpp: Added.

(WTF::printInternal):

• dfg/DFGAbstractInterpreterClobberState.h: Added.

(JSC::DFG::mergeClobberStates):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberWorld):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberStructures):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber): Deleted.

• dfg/DFGAtTailAbstractState.h:

(JSC::DFG::AtTailAbstractState::setClobberState):
(JSC::DFG::AtTailAbstractState::mergeClobberState):
(JSC::DFG::AtTailAbstractState::setDidClobber): Deleted.

• dfg/DFGCFAPhase.cpp:

(JSC::DFG::CFAPhase::performBlockCFA):

• dfg/DFGClobberSet.cpp:

(JSC::DFG::writeSet):

• dfg/DFGClobberSet.h:
• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGInPlaceAbstractState.h:

(JSC::DFG::InPlaceAbstractState::clobberState const):
(JSC::DFG::InPlaceAbstractState::didClobberOrFolded const):
(JSC::DFG::InPlaceAbstractState::didClobber const):
(JSC::DFG::InPlaceAbstractState::setClobberState):
(JSC::DFG::InPlaceAbstractState::mergeClobberState):
(JSC::DFG::InPlaceAbstractState::setDidClobber): Deleted.

File:

• trunk/Source/JavaScriptCore/dfg/DFGClobberSet.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGClobberSet.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -159 +159 @@
 }
 
+ClobberSet writeSet(Graph& graph, Node* node)
+{
+    ClobberSet result;
+    addWrites(graph, node, result);
+    return result;
+}
+
 bool readsOverlap(Graph& graph, Node* node, ClobberSet& readSet)
 {