148649 2015-08-31 15:10:33 -0700 DFG AI assertions about not having to do type checks at the point of a Known use kind are unsound 2015-09-01 11:27:51 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other All All RESOLVED FIXED P2 Normal --- 148610 1 fpizlo fpizlo oldest_to_newest 1122311 0 fpizlo 2015-08-31 15:10:33 -0700 We often generate IR like: Check(Int32:@x) ... Foo(KnownInt32:@x) It would be valid for any optimization that somehow proves the type of @x to remove the Check node entirely. But then, AI might fail on an assertion at Foo() because of the KnownInt32 use kind, if AI isn't smart enough to construct the same proof that the former optimization used for removing the Check. The correct solution is probably to remove the compile-time assertions about Known use kinds having already been checked. It's OK for those to be debug-only JIT assertions. 1122312 1 fpizlo 2015-08-31 15:11:41 -0700 I might end up fixing this before I do property type inference. It looks like that code might reveal this bug. 1122576 2 260369 fpizlo 2015-09-01 10:42:52 -0700 Created attachment 260369 the patch 1122581 3 260369 saam 2015-09-01 10:44:19 -0700 Comment on attachment 260369 the patch r=me 1122602 4 fpizlo 2015-09-01 11:27:51 -0700 Landed in http://trac.webkit.org/changeset/189219 260369 2015-09-01 10:42:52 -0700 2015-09-01 10:44:19 -0700 the patch blah.patch text/plain 2206 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTg5MjE2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI3IEBA CisyMDE1LTA5LTAxICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg REZHIEFJIGFzc2VydGlvbnMgYWJvdXQgbm90IGhhdmluZyB0byBkbyB0eXBlIGNoZWNrcyBhdCB0 aGUgcG9pbnQgb2YgYSBLbm93biB1c2Uga2luZCBhcmUgdW5zb3VuZAorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ4NjQ5CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2Ugb2Z0ZW4gZ2VuZXJhdGUgSVIgbGlr ZToKKworICAgICAgICBDaGVjayhJbnQzMjpAeCkKKyAgICAgICAgLi4uCisgICAgICAgIEZvbyhL bm93bkludDMyOkB4KQorCisgICAgICAgIEl0IHdvdWxkIGJlIHZhbGlkIGZvciBhbnkgb3B0aW1p emF0aW9uIHRoYXQgc29tZWhvdyBwcm92ZXMgdGhlIHR5cGUgb2YgQHggdG8gcmVtb3ZlIHRoZQor ICAgICAgICBDaGVjayBub2RlIGVudGlyZWx5LiBCdXQgdGhlbiwgQUkgbWlnaHQgZmFpbCBvbiBh biBhc3NlcnRpb24gYXQgRm9vKCkgYmVjYXVzZSBvZiB0aGUKKyAgICAgICAgS25vd25JbnQzMiB1 c2Uga2luZCwgaWYgQUkgaXNuJ3Qgc21hcnQgZW5vdWdoIHRvIGNvbnN0cnVjdCB0aGUgc2FtZSBw cm9vZiB0aGF0IHRoZSBmb3JtZXIKKyAgICAgICAgb3B0aW1pemF0aW9uIHVzZWQgZm9yIHJlbW92 aW5nIHRoZSBDaGVjay4KKworICAgICAgICBUaGUgY29ycmVjdCBzb2x1dGlvbiBpcyB0byByZW1v dmUgdGhlIGNvbXBpbGUtdGltZSBhc3NlcnRpb25zIGFib3V0IEtub3duIHVzZSBraW5kcworICAg ICAgICBoYXZpbmcgYWxyZWFkeSBiZWVuIGNoZWNrZWQuCisKKyAgICAgICAgKiBkZmcvREZHQWJz dHJhY3RJbnRlcnByZXRlcklubGluZXMuaDoKKyAgICAgICAgKEpTQzo6REZHOjpBYnN0cmFjdElu dGVycHJldGVyPEFic3RyYWN0U3RhdGVUeXBlPjo6dmVyaWZ5RWRnZSk6CisKIDIwMTUtMDgtMzEg IFl1c3VrZSBTdXp1a2kgIDx1dGF0YW5lLnRlYUBnbWFpbC5jb20+CiAKICAgICAgICAgW0VTNl0g SW50cm9kdWNlIE1vZHVsZVByb2dyYW1FeGVjdXRhYmxlIGZhbWlsaWVzIGFuZCBjb21waWxlIE1v ZHVsZSBjb2RlIHRvIGJ5dGVjb2RlCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG R0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFT Y3JpcHRDb3JlL2RmZy9ERkdBYnN0cmFjdEludGVycHJldGVySW5saW5lcy5oCShyZXZpc2lvbiAx ODg4NzgpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fic3RyYWN0SW50ZXJwcmV0 ZXJJbmxpbmVzLmgJKHdvcmtpbmcgY29weSkKQEAgLTEwOCw2ICsxMDgsMTIgQEAgdm9pZCBBYnN0 cmFjdEludGVycHJldGVyPEFic3RyYWN0U3RhdGVUeQogdGVtcGxhdGU8dHlwZW5hbWUgQWJzdHJh Y3RTdGF0ZVR5cGU+CiB2b2lkIEFic3RyYWN0SW50ZXJwcmV0ZXI8QWJzdHJhY3RTdGF0ZVR5cGU+ Ojp2ZXJpZnlFZGdlKE5vZGUqIG5vZGUsIEVkZ2UgZWRnZSkKIHsKKyAgICAvLyBTb21lIHVzZSBr aW5kcyBhcmUgcmVxdWlyZWQgdG8gbm90IGhhdmUgY2hlY2tzLCBiZWNhdXNlIHdlIGtub3cgc29t ZWhvdyB0aGF0IHRoZSBpbmNvbWluZworICAgIC8vIHZhbHVlIHdpbGwgYWxyZWFkeSBoYXZlIHRo ZSB0eXBlIHdlIHdhbnQuIEluIHRob3NlIGNhc2VzLCBBSSBtYXkgbm90IGJlIHNtYXJ0IGVub3Vn aCB0bworICAgIC8vIHByb3ZlIHRoYXQgdGhpcyBpcyBpbmRlZWQgdGhlIGNhc2UuCisgICAgaWYg KHNob3VsZE5vdEhhdmVUeXBlQ2hlY2soZWRnZS51c2VLaW5kKCkpKQorICAgICAgICByZXR1cm47 CisgICAgCiAgICAgaWYgKCEoZm9yTm9kZShlZGdlKS5tX3R5cGUgJiB+dHlwZUZpbHRlckZvcihl ZGdlLnVzZUtpbmQoKSkpKQogICAgICAgICByZXR1cm47CiAgICAgCg==