159388 2016-07-02 20:53:55 -0700 DFG LICM needs to go all-in on the idea that some loops can't be LICMed 2016-07-03 10:48:44 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED P2 Normal --- 1 fpizlo fpizlo commit-queue keith_miller mark.lam msaboff saam oldest_to_newest 1207483 0 fpizlo 2016-07-02 20:53:55 -0700 Some time ago I acknowledged that LICM required loops to meet certain requirements that may get broken by the time we do LICM, like that the terminal of the pre-header is ExitOK. It used to be that we just ignored that requirement and would hoist anyway, but since r189126 we've stopped hoisting out of loops that don't have ExitOK. We also added tests for the case that the pre-header doesn't exist or is invalid. It turns out that this patch didn't go far enough: even though it made LICM avoid loops that had an invalid pre-header, the part that updated the AI state in nested loops still assumed that these loops had valid pre-headers. We would crash in null dereference in that loop if a nested loop had an invalid pre-header. The fix is simple: don't update the AI state of nested loops that don't have pre-headers, since we won't try to hoist out of those loops anyway. 1207484 1 282653 fpizlo 2016-07-02 21:00:49 -0700 Created attachment 282653 the patch 1207491 2 282653 mark.lam 2016-07-03 06:15:24 -0700 Comment on attachment 282653 the patch r=me. 1207502 3 fpizlo 2016-07-03 10:48:44 -0700 Landed in https://trac.webkit.org/changeset/202790 and https://trac.webkit.org/changeset/202791 282653 2016-07-02 21:00:49 -0700 2016-07-03 06:15:24 -0700 the patch blah.patch text/plain 4663 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjAyNzg1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDMyIEBA CisyMDE2LTA3LTAyICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg REZHIExJQ00gbmVlZHMgdG8gZ28gYWxsLWluIG9uIHRoZSBpZGVhIHRoYXQgc29tZSBsb29wcyBj YW4ndCBiZSBMSUNNZWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTE1OTM4OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorICAg ICAgICAKKyAgICAgICAgU29tZSB0aW1lIGFnbyBJIGFja25vd2xlZGdlZCB0aGF0IExJQ00gcmVx dWlyZWQgbG9vcHMgdG8gbWVldCBjZXJ0YWluIHJlcXVpcmVtZW50cyB0aGF0CisgICAgICAgIG1h eSBnZXQgYnJva2VuIGJ5IHRoZSB0aW1lIHdlIGRvIExJQ00sIGxpa2UgdGhhdCB0aGUgdGVybWlu YWwgb2YgdGhlIHByZS1oZWFkZXIgaXMgRXhpdE9LLgorICAgICAgICBJdCB1c2VkIHRvIGJlIHRo YXQgd2UganVzdCBpZ25vcmVkIHRoYXQgcmVxdWlyZW1lbnQgYW5kIHdvdWxkIGhvaXN0IGFueXdh eSwgYnV0IHNpbmNlCisgICAgICAgIHIxODkxMjYgd2UndmUgc3RvcHBlZCBob2lzdGluZyBvdXQg b2YgbG9vcHMgdGhhdCBkb24ndCBoYXZlIEV4aXRPSy4gIFdlIGFsc28gYWRkZWQgdGVzdHMKKyAg ICAgICAgZm9yIHRoZSBjYXNlIHRoYXQgdGhlIHByZS1oZWFkZXIgZG9lc24ndCBleGlzdCBvciBp cyBpbnZhbGlkLgorCisgICAgICAgIEl0IHR1cm5zIG91dCB0aGF0IHRoaXMgcGF0Y2ggZGlkbid0 IGdvIGZhciBlbm91Z2g6IGV2ZW4gdGhvdWdoIGl0IG1hZGUgTElDTSBhdm9pZCBsb29wcworICAg ICAgICB0aGF0IGhhZCBhbiBpbnZhbGlkIHByZS1oZWFkZXIsIHRoZSBwYXJ0IHRoYXQgdXBkYXRl ZCB0aGUgQUkgc3RhdGUgaW4gbmVzdGVkIGxvb3BzIHN0aWxsCisgICAgICAgIGFzc3VtZWQgdGhh dCB0aGVzZSBsb29wcyBoYWQgdmFsaWQgcHJlLWhlYWRlcnMuICBXZSB3b3VsZCBjcmFzaCBpbiBu dWxsIGRlcmVmZXJlbmNlIGluCisgICAgICAgIHRoYXQgbG9vcCBpZiBhIG5lc3RlZCBsb29wIGhh ZCBhbiBpbnZhbGlkIHByZS1oZWFkZXIuCisKKyAgICAgICAgVGhlIGZpeCBpcyBzaW1wbGU6IGRv bid0IHVwZGF0ZSB0aGUgQUkgc3RhdGUgb2YgbmVzdGVkIGxvb3BzIHRoYXQgZG9uJ3QgaGF2ZSBw cmUtaGVhZGVycywKKyAgICAgICAgc2luY2Ugd2Ugd29uJ3QgdHJ5IHRvIGhvaXN0IG91dCBvZiB0 aG9zZSBsb29wcyBhbnl3YXkuCisKKyAgICAgICAgKiBkZmcvREZHTElDTVBoYXNlLmNwcDoKKyAg ICAgICAgKEpTQzo6REZHOjpMSUNNUGhhc2U6OmF0dGVtcHRIb2lzdCk6CisgICAgICAgICogdGVz dHMvc3RyZXNzL2xpY20tbm8tcHJlLWhlYWRlci1uZXN0ZWQuanM6IEFkZGVkLiBUaGlzIHdvdWxk IGFsd2F5cyBjcmFzaCBiZWZvcmUgdGhpcyBmaXguCisgICAgICAgIChmb28pOgorICAgICAgICAq IHRlc3RzL3N0cmVzcy9saWNtLXByZS1oZWFkZXItY2Fubm90LWV4aXQtbmVzdGVkLmpzOiBBZGRl ZC4gVGhpcyB3YXMgYSBmYWlsZWQgYXR0ZW1wdCBhdCBhIHRlc3QsIGJ1dCBJIGZpZ3VyZSBpdCdz IGdvb2QgdG8gaGF2ZSB3ZWlyZCBjb2RlIGFueXdheS4KKyAgICAgICAgKGZvbyk6CisgICAgICAg ICh2YWx1ZU9mKToKKwogMjAxNi0wNi0zMCAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29t PgogCiAgICAgICAgIFNjb3BlcyB0aGF0IGFyZSBub3QgdW5kZXIgVERaIHNob3VsZCBzdGlsbCBw dXNoIHRoZWlyIHZhcmlhYmxlcyBvbnRvIHRoZSBURFogc3RhY2sgc28gdGhhdCBsaWZ0aW5nIFRE WiBkb2Vzbid0IGJ5cGFzcyB0aGF0IHNjb3BlCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUv ZGZnL0RGR0xJQ01QaGFzZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3Jl L2RmZy9ERkdMSUNNUGhhc2UuY3BwCShyZXZpc2lvbiAyMDI3ODEpCisrKyBTb3VyY2UvSmF2YVNj cmlwdENvcmUvZGZnL0RGR0xJQ01QaGFzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTMyNCw2ICsz MjQsMTIgQEAgcHJpdmF0ZToKICAgICAgICAgICAgIGlmICghc3ViTG9vcCkKICAgICAgICAgICAg ICAgICBjb250aW51ZTsKICAgICAgICAgICAgIEJhc2ljQmxvY2sqIHN1YlByZUhlYWRlciA9IG1f ZGF0YVtzdWJMb29wLT5pbmRleCgpXS5wcmVIZWFkZXI7CisgICAgICAgICAgICAvLyBXZSBtYXkg bm90IGhhdmUgZ2l2ZW4gdGhpcyBsb29wIGEgcHJlLWhlYWRlciBiZWNhdXNlIGVpdGhlciBpdCBk aWRuJ3QgaGF2ZSBleGl0T0sKKyAgICAgICAgICAgIC8vIG9yIHRoZSBoZWFkZXIgaGFkIG11bHRp cGxlIHByZWRlY2Vzc29ycyB0aGF0IGl0IGRpZCBub3QgZG9taW5hdGUuIEluIHRoYXQgY2FzZSB0 aGUKKyAgICAgICAgICAgIC8vIGxvb3Agd291bGRuJ3QgYmUgYSBob2lzdGluZyBjYW5kaWRhdGUg YW55d2F5LCBzbyB3ZSBkb24ndCBoYXZlIHRvIGRvIGFueXRoaW5nLgorICAgICAgICAgICAgaWYg KCFzdWJQcmVIZWFkZXIpCisgICAgICAgICAgICAgICAgY29udGludWU7CisgICAgICAgICAgICAv LyBUaGUgcHJlLWhlYWRlcidzIHRhaWwgbWF5IGJlIHVucmVhY2hhYmxlLCBpbiB3aGljaCBjYXNl IHdlIGhhdmUgbm90aGluZyB0byBkby4KICAgICAgICAgICAgIGlmICghc3ViUHJlSGVhZGVyLT5j ZmFEaWRGaW5pc2gpCiAgICAgICAgICAgICAgICAgY29udGludWU7CiAgICAgICAgICAgICBtX3N0 YXRlLmluaXRpYWxpemVUbyhzdWJQcmVIZWFkZXIpOwpJbmRleDogU291cmNlL0phdmFTY3JpcHRD b3JlL3Rlc3RzL3N0cmVzcy9saWNtLW5vLXByZS1oZWFkZXItbmVzdGVkLmpzCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvbGljbS1uby1wcmUtaGVhZGVy LW5lc3RlZC5qcwkocmV2aXNpb24gMCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9z dHJlc3MvbGljbS1uby1wcmUtaGVhZGVyLW5lc3RlZC5qcwkod29ya2luZyBjb3B5KQpAQCAtMCww ICsxLDIzIEBACisvL0AgcnVuTWlzY0ZUTE5vQ0pJVFRlc3QoIi0tY3JlYXRlUHJlSGVhZGVycz1m YWxzZSIpCisKK2Z1bmN0aW9uIGZvbyhhcnJheSwgeSkgeworICAgIHZhciB4ID0gMDsKKyAgICB2 YXIgaiA9IDA7CisgICAgZG8geworICAgICAgICB4ID0geSAqIDM7CisgICAgICAgIHZhciByZXN1 bHQgPSAwOworICAgICAgICB2YXIgaSA9IDA7CisgICAgICAgIGlmICghYXJyYXkubGVuZ3RoKQor ICAgICAgICAgICAgYXJyYXkgPSBbMV07CisgICAgICAgIGRvIHsKKyAgICAgICAgICAgIHJlc3Vs dCArPSBhcnJheVtpKytdOworICAgICAgICB9IHdoaWxlIChpIDwgYXJyYXkubGVuZ3RoKQorICAg ICAgICBqKys7CisgICAgfSB3aGlsZSAoaiA8IDMpOworICAgIHJldHVybiByZXN1bHQgKyB4Owor fQorCitub0lubGluZShmb28pOworCitmb3IgKHZhciBpID0gMDsgaSA8IDEwMDAwOyArK2kpCisg ICAgZm9vKFsxLCAyLCAzXSwgNDIpOwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3Rz L3N0cmVzcy9saWNtLXByZS1oZWFkZXItY2Fubm90LWV4aXQtbmVzdGVkLmpzCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvbGljbS1wcmUtaGVhZGVyLWNh bm5vdC1leGl0LW5lc3RlZC5qcwkocmV2aXNpb24gMCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS90ZXN0cy9zdHJlc3MvbGljbS1wcmUtaGVhZGVyLWNhbm5vdC1leGl0LW5lc3RlZC5qcwkod29y a2luZyBjb3B5KQpAQCAtMCwwICsxLDIxIEBACisvL0AgcnVuTWlzY0ZUTE5vQ0pJVFRlc3QoIi0t Y3JlYXRlUHJlSGVhZGVycz1mYWxzZSIpCisKK2Z1bmN0aW9uIGZvbyhvYmplY3QsIHByZWRpY2F0 ZSkgeworICAgIGZvciAodmFyIGogPSAwOyBqIDwgMTA7ICsraikgeworICAgICAgICB2YXIgcmVz dWx0ID0gMDsKKyAgICAgICAgdmFyIGkgPSAwOworICAgICAgICBpZiAoREZHVHJ1ZSgpKQorICAg ICAgICAgICAgcHJlZGljYXRlID0gNDI7CisgICAgICAgIHdoaWxlIChwcmVkaWNhdGUgPj0gNDIp IHsKKyAgICAgICAgICAgIHJlc3VsdCArPSBvYmplY3QuYXJyYXlbaSsrXTsKKyAgICAgICAgICAg IGlmIChpID49IG9iamVjdC5hcnJheS5sZW5ndGgpCisgICAgICAgICAgICAgICAgYnJlYWs7Cisg ICAgICAgIH0KKyAgICB9CisgICAgcmV0dXJuIHJlc3VsdDsKK30KKworbm9JbmxpbmUoZm9vKTsK KworZm9yICh2YXIgaSA9IDA7IGkgPCAxMDAwMDsgKytpKQorICAgIGZvbyh7YXJyYXk6IFsxLCAy LCAzXX0sIHt2YWx1ZU9mOiBmdW5jdGlvbigpIHsgcmV0dXJuIDQyOyB9fSk7Cg==