Changeset 267726 in webkit for trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

Timestamp:

Sep 28, 2020, 9:54:36 PM (5 years ago)

Author:

[email protected]

Message:

Add Bounds Check Elimination validation for debugging.
​https://bugs.webkit.org/show_bug.cgi?id=217055
rdar://69122891

Reviewed by Keith Miller.

Source/JavaScriptCore:

Added a JSC_validateBoundsCheckElimination option (with alias
JSC_validateBCE) that adds an AssertInBounds whenever a CheckInBounds
node is elided.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGIntegerCheckCombiningPhase.cpp:

(JSC::DFG::IntegerCheckCombiningPhase::handleBlock):

• dfg/DFGIntegerRangeOptimizationPhase.cpp:
• dfg/DFGNodeType.h:
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGValidate.cpp:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileAssertNotEmpty):
(JSC::FTL::DFG::LowerDFGToB3::compileAssertInBounds):

• ftl/FTLOperations.cpp:

(JSC::FTL::operationReportBoundsCheckEliminationErrorAndCrash):

• ftl/FTLOperations.h:
• runtime/OptionsList.h:

Tools:

Added --validateBCE=true to ftl-no-cjit-validate-sampling-profiler
and ftl-eager-no-cjit.

• Scripts/run-jsc-stress-tests:

File:

• trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1336 +1336 @@
                     if (nonNegative && lessThanLength) {
                         executeNode(block->at(nodeIndex));
+                        if (UNLIKELY(Options::validateBoundsCheckElimination()))
+                            m_insertionSet.insertNode(nodeIndex, SpecNone, AssertInBounds, node->origin, node->child1(), node->child2());
                         // We just need to make sure we are a value-producing node.
                         node->convertToIdentityOn(node->child1().node());