Changeset 249976 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

Timestamp:

Sep 17, 2019, 12:52:43 PM (6 years ago)

Author:

[email protected]

Message:

[JSC] CheckArray+NonArray is not filtering out Array in AI
​https://bugs.webkit.org/show_bug.cgi?id=201857
<rdar://problem/54194820>

Reviewed by Keith Miller.

JSTests:

• stress/check-array-with-non-array-does-not-filter-arrays.js: Added.

(foo):

Source/JavaScriptCore:

The code of DFG::ArrayMode::alreadyChecked is different from SpeculativeJIT's CheckArray / CheckStructure.
While we assume CheckArray+NonArray ensures it only passes non-array inputs, DFG::ArrayMode::alreadyChecked
accepts arrays too. So CheckArray+NonArray is removed in AI if the input is proven that it is an array.
This patch aligns DFG::ArrayMode::alreadyChecked to the checks done at runtime.

• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::alreadyChecked const):

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

@@ -418 +418 @@
 bool ArrayMode::alreadyChecked(Graph& graph, Node* node, const AbstractValue& value, IndexingType shape) const
 {
+    ASSERT(isSpecific());
+
+    IndexingType indexingModeMask = IsArray | IndexingShapeMask;
+    if (action() == Array::Write)
+        indexingModeMask |= CopyOnWrite;
+
     switch (arrayClass()) {
-    case Array::OriginalArray: {
-        if (value.m_structure.isTop())
+    case Array::Array: {
+        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(shape | IsArray)))
+            return true;
+        if (!value.m_structure.isFinite())
             return false;
         for (unsigned i = value.m_structure.size(); i--;) {
             RegisteredStructure structure = value.m_structure[i];
-            if ((structure->indexingType() & IndexingShapeMask) != shape)
+            if ((structure->indexingMode() & indexingModeMask) != (shape | IsArray))
                 return false;
-            if (isCopyOnWrite(structure->indexingMode()) && action() == Array::Write)
-                return false;
-            if (!(structure->indexingType() & IsArray))
-                return false;
-            if (!graph.globalObjectFor(node->origin.semantic)->isOriginalArrayStructure(structure.get()))
-                return false;
         }
         return true;
     }
-        
-    case Array::Array: {
-        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(shape | IsArray)))
+
+    // Array::OriginalNonArray can be shown when the value is a TypedArray with original structure.
+    // But here, we already filtered TypedArrays. So, just handle it like a NonArray.
+    case Array::OriginalNonArray:
+    case Array::NonArray: {
+        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(shape)))
             return true;
-        if (value.m_structure.isTop())
+        if (!value.m_structure.isFinite())
             return false;
         for (unsigned i = value.m_structure.size(); i--;) {
             RegisteredStructure structure = value.m_structure[i];
-            if ((structure->indexingMode() & IndexingShapeMask) != shape)
+            if ((structure->indexingMode() & indexingModeMask) != shape)
                 return false;
-            if (isCopyOnWrite(structure->indexingMode()) && action() == Array::Write)
-                return false;
-            if (!(structure->indexingType() & IsArray))
-                return false;
         }
         return true;
     }
-        
-    default: {
+
+    case Array::PossiblyArray: {
         if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(shape) | asArrayModesIgnoringTypedArrays(shape | IsArray)))
             return true;
-        if (value.m_structure.isTop())
+        if (!value.m_structure.isFinite())
             return false;
         for (unsigned i = value.m_structure.size(); i--;) {
             RegisteredStructure structure = value.m_structure[i];
-            if ((structure->indexingMode() & IndexingShapeMask) != shape)
+            if ((structure->indexingMode() & (indexingModeMask & ~IsArray)) != shape)
                 return false;
-            if (isCopyOnWrite(structure->indexingMode()) && action() == Array::Write)
-                return false;
         }
         return true;
-    } }
+    }
+
+    // If ArrayMode is Array::OriginalCopyOnWriteArray or Array::OriginalArray, CheckArray is never emitted. Instead, we always emit CheckStructure.
+    // So, we should perform the same check to the CheckStructure here.
+    case Array::OriginalArray:
+    case Array::OriginalCopyOnWriteArray: {
+        if (!value.m_structure.isFinite())
+            return false;
+        Structure* originalStructure = originalArrayStructure(graph, node);
+        if (value.m_structure.size() != 1)
+            return false;
+        return value.m_structure.onlyStructure().get() == originalStructure;
+    }
+    }
 }