Changeset 262425 in webkit for trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

Timestamp:

Jun 2, 2020, 9:55:15 AM (5 years ago)

Author:

[email protected]

Message:

MultiDeleteByOffset should not always def
​https://bugs.webkit.org/show_bug.cgi?id=212621
<rdar://problem/63824182>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/multi-del-by-offset-doesnt-always-def-osr-entry.js: Added.

(foo):

• stress/multi-del-by-offset-doesnt-always-def.js: Added.

(foo):
(let.p.set undefined):

Source/JavaScriptCore:

Clobberize used to claim that MultiDeleteByOffset always defd a value.
That's an incorrect modeling of MultiDeleteByOffset though, since it might
have delete misses in its variant list. This would lead us to incorrectly
CSE when we shouldn't. This patch fixes this by saying MultiDeleteByOffset
only defs when all its cases write out a value (are hits).

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGNode.cpp:

(JSC::DFG::MultiDeleteByOffsetData::allVariantsStoreEmpty const):

• dfg/DFGNode.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMultiDeleteByOffset):

File:

• trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -8472 +8472 @@
             m_out.appendTo(blocks[block], block + 1 < blocks.size() ? blocks[block + 1] : exit);
 
-            if (variant.newStructure()) {
-                LValue storage;
-
-                if (isInlineOffset(variant.offset()))
-                    storage = base;
-                else
-                    storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
-
-                storeProperty(m_out.int64Zero, storage, data.identifierNumber, variant.offset());
-
-                ASSERT(variant.oldStructure()->indexingType() == variant.newStructure()->indexingType());
-                ASSERT(variant.oldStructure()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
-                ASSERT(variant.oldStructure()->typeInfo().type() == variant.newStructure()->typeInfo().type());
-                m_out.store32(
-                    weakStructureID(m_graph.registerStructure(variant.newStructure())), base, m_heaps.JSCell_structureID);
-            }
+            LValue storage;
+
+            if (isInlineOffset(variant.offset()))
+                storage = base;
+            else
+                storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
+
+            storeProperty(m_out.int64Zero, storage, data.identifierNumber, variant.offset());
+
+            ASSERT(variant.oldStructure()->indexingType() == variant.newStructure()->indexingType());
+            ASSERT(variant.oldStructure()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
+            ASSERT(variant.oldStructure()->typeInfo().type() == variant.newStructure()->typeInfo().type());
+            m_out.store32(
+                weakStructureID(m_graph.registerStructure(variant.newStructure())), base, m_heaps.JSCell_structureID);
 
             results.append(m_out.anchor(variant.result() ? m_out.booleanTrue : m_out.booleanFalse));