Changeset 235538 in webkit for trunk/Source/JavaScriptCore/dfg/DFGNode.cpp

Timestamp:

Aug 31, 2018, 12:45:02 AM (7 years ago)

Author:

[email protected]

Message:

convertToRegExpMatchFastGlobal must use KnownString as the child use kind
​https://bugs.webkit.org/show_bug.cgi?id=189173
<rdar://problem/43501645>

Reviewed by Michael Saboff.

JSTests:

• stress/may-exit-should-be-false-regexp-constant-folding.js: Added.

(foo):
(bar):

Source/JavaScriptCore:

We were crashing during validation because mayExit returned true
at a point in the program when we weren't allowed to exit.

The issue was is in StrengthReduction: we end up emitting code that
had a StringUse on an edge after a node that did side effects and before
an ExitOK/bytecode number transition. However, StrenghReduction did the
right thing here and also emitted the type checks before the node with
side effects. It just did bad bookkeeping. The node we convert to needs
to use KnownStringUse instead of StringUse for the child edge.

• dfg/DFGNode.cpp:

(JSC::DFG::Node::convertToRegExpExecNonGlobalOrStickyWithoutChecks):
(JSC::DFG::Node::convertToRegExpMatchFastGlobalWithoutChecks):
(JSC::DFG::Node::convertToRegExpExecNonGlobalOrSticky): Deleted.
(JSC::DFG::Node::convertToRegExpMatchFastGlobal): Deleted.

• dfg/DFGNode.h:
• dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

File:

• trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGNode.cpp

@@ -269 +269 @@
 }
 
-void Node::convertToRegExpExecNonGlobalOrSticky(FrozenValue* regExp)
+void Node::convertToRegExpExecNonGlobalOrStickyWithoutChecks(FrozenValue* regExp)
 {
     ASSERT(op() == RegExpExec);
     setOpAndDefaultFlags(RegExpExecNonGlobalOrSticky);
     children.child1() = Edge(children.child1().node(), KnownCellUse);
-    children.child2() = Edge(children.child3().node(), StringUse);
+    children.child2() = Edge(children.child3().node(), KnownStringUse);
     children.child3() = Edge();
     m_opInfo = regExp;
 }
 
-void Node::convertToRegExpMatchFastGlobal(FrozenValue* regExp)
+void Node::convertToRegExpMatchFastGlobalWithoutChecks(FrozenValue* regExp)
 {
     ASSERT(op() == RegExpMatchFast);
     setOpAndDefaultFlags(RegExpMatchFastGlobal);
     children.child1() = Edge(children.child1().node(), KnownCellUse);
-    children.child2() = Edge(children.child3().node(), StringUse);
+    children.child2() = Edge(children.child3().node(), KnownStringUse);
     children.child3() = Edge();
     m_opInfo = regExp;