158438 2016-06-06 15:31:29 -0700 EXITs when using spread operator with mixed type array 2016-06-06 15:31:29 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified NEW P2 Normal --- 1 joepeck webkit-unassigned fpizlo keith_miller mark.lam saam oldest_to_newest 1199733 0 280637 joepeck 2016-06-06 15:31:29 -0700 Created attachment 280637 [TEST] Test case * SUMMARY EXITs when using spread operator with mixed type array. * TEST (function() { function myLog() { var args = Array.from(arguments); print(args.join(" ")); } function myAssert(condition, ...args) { "use strict"; if (!condition) myLog(...args); } noInline(myLog); noInline(myAssert); for (var i = 0; i < 1e6; ++i) myAssert((i % 1e4), "Expected Failure", i); })(); * STEPS TO REPRODUCE 1. jsc test.js -p profile => Profile shows "Bad Type" errors when handling the spread operator * PROFILE Lots more Baseline/DFG runs then expected due to exists. > l myAssert Compilation myAssert#CCcDJe-1-Baseline: Total count: 240941 Max count: 20064 Compilation myAssert#CCcDJe-2-DFG: Total count: 701430 Max count: 58445 EXIT: at bc#190 due to BadType, 5 times Compilation myAssert#CCcDJe-3-FTL: Total count: 11061788 Max count: 921463 Exits are when spreading the array via inlined array iterator code > b myAssert ... [ 169] get_by_id loc17, loc16, done(@id4) predicting None [ 178] jtrue loc17, 50(->228) [ 181] get_by_id loc16, loc16, value(@id5) predicting None [ 190] jmp -104(->86) !!!!! EXIT: in myAssert#CCcDJe-2-DFG due to BadType, 5 times ... Looks like it was predicting Boolint32, but the spreaded array (the rest param) should always have [String ("Expected Failure"), int32 (i)]. So that prediction seems unexpected. > d myAssert ... 9/5/184/0 185:< 3:loc14> GetByOffset(KnownCell:@182, KnownCell:@182, JS|UseAsOther, Boolint32, id5{value}, 1, inferredType = Top, R:NamedProperties(5), Exits, bc#181) predicting Boolint32 9/5/184/0 0x3baa19e02d1a: mov 0x18(%rax), %rsi 9/5/184/0 186:<!0:-> MovHint(Untyped:@185, MustGen, loc16, W:SideState, ClobbersExit, bc#181) 9/5/184/0 187:<!0:-> Check(Check:Int32:@185, MustGen, Exits, bc#181, exit: bc#190) 9/5/184/0 0x3baa19e02d1e: cmp %r14, %rsi 9/5/184/0 0x3baa19e02d21: jb 0x3baa19e0335f !!!!! EXIT: due to BadType, 5 times ... 280637 2016-06-06 15:31:29 -0700 2016-06-06 15:31:29 -0700 [TEST] Test case spread-bench.js application/x-javascript 452 joepeck dmFyIHN0YXJ0ID0gRGF0ZS5ub3coKTsKCihmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIG15TG9n KCkgewogICAgICAgIHZhciBhcmdzID0gQXJyYXkuZnJvbShhcmd1bWVudHMpOwogICAgICAgIHBy aW50KGFyZ3Muam9pbigiICIpKTsKICAgIH0KICAgIGZ1bmN0aW9uIG15QXNzZXJ0KGNvbmRpdGlv biwgLi4uYXJncykgewogICAgICAgICJ1c2Ugc3RyaWN0IjsKICAgICAgICBpZiAoIWNvbmRpdGlv bikKICAgICAgICAgICAgbXlMb2coLi4uYXJncyk7CiAgICB9CgogICAgbm9JbmxpbmUobXlMb2cp OwogICAgbm9JbmxpbmUobXlBc3NlcnQpOwoKICAgIGZvciAodmFyIGkgPSAwOyBpIDwgMWU2OyAr K2kpCiAgICAgICAgbXlBc3NlcnQoKGkgJSAxZTQpLCAiRXhwZWN0ZWQgRmFpbHVyZSIsIGkpOwp9 KSgpOwoKdmFyIGVuZCA9IERhdGUubm93KCk7CnByaW50KChlbmQtc3RhcnQpKyJtcyIpOwo=