159942 2016-07-19 13:15:05 -0700 HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit 2016-10-08 11:34:49 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 saam saam benjamin commit-queue fpizlo ggaren gskachkov keith_miller mark.lam msaboff oliver sukolsak webkit-bug-importer ysuzuki oldest_to_newest 1212483 0 saam 2016-07-19 13:15:05 -0700 ... 1212485 1 saam 2016-07-19 13:15:45 -0700 <rdar://problem/27328836> 1235449 2 290393 saam 2016-09-30 15:07:38 -0700 Created attachment 290393 patch 1235450 3 290393 fpizlo 2016-09-30 15:09:04 -0700 Comment on attachment 290393 patch View in context: https://bugs.webkit.org/attachment.cgi?id=290393&action=review Ouch. R=me. > Source/JavaScriptCore/dfg/DFGClobberize.h:267 > + if (mode.type() == Array::ForceExit) { > + write(SideState); > + return; > + } > + Why didn't you put this in the switch statement, below? 1235455 4 290397 saam 2016-09-30 15:15:03 -0700 Created attachment 290397 patch for landing 1235533 5 saam 2016-09-30 17:58:11 -0700 I'm going to try to find a repro test before landing, but it might be tricky 1236838 6 saam 2016-10-05 17:18:21 -0700 (In reply to comment #5) > I'm going to try to find a repro test before landing, but it might be tricky This is difficult to do. 1236840 7 saam 2016-10-05 17:19:33 -0700 (In reply to comment #6) > (In reply to comment #5) > > I'm going to try to find a repro test before landing, but it might be tricky > > This is difficult to do. Basically, we need to profile something as contiguousInbounds, and then somehow not have a prediction for either the base or the index. 1237982 8 saam 2016-10-08 11:11:33 -0700 Ok, I'm going to give up on trying to get this to reproduce on ToT. It's pretty clear what the bug is, but it's probably quite difficult to write a program that exhibits the bug. Anyways, I'm going to commit this change for now and then if I find a way to write a test that exhibits the bug, I'll check in the test later. 1237986 9 290397 commit-queue 2016-10-08 11:34:44 -0700 Comment on attachment 290397 patch for landing Clearing flags on attachment: 290397 Committed r206955: <http://trac.webkit.org/changeset/206955> 1237987 10 commit-queue 2016-10-08 11:34:49 -0700 All reviewed patches have been landed. Closing bug. 290393 2016-09-30 15:07:38 -0700 2016-09-30 15:15:03 -0700 patch c-backup.diff text/plain 1562 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA2Njc5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE2LTA5LTMwICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IEhhc0luZGV4ZWRQcm9wZXJ0eSBjbG9iYmVyaXplIHJ1bGUgaXMgd3JvbmcgZm9yIEFycmF5OjpG b3JjZU9TUkV4aXQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTE1OTk0MgorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjczMjg4MzY+CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2hlbiBpdCdzIGluIEZvcmNl T1NSRXhpdCBhcnJheSBtb2RlLCBpdCBzaG91bGQgcmVwb3J0IHRvIHdyaXRlIHRvIHNpZGUKKyAg ICAgICAgc3RhdGUsIGxpa2UgdGhlIEZvcmNlT1NSRXhpdCBub2RlLCBhbmQgdGhlIG90aGVyIG5v ZGVzIHdpdGggRm9yY2VPU1JFeGl0CisgICAgICAgIGFycmF5IG1vZGUuCisKKyAgICAgICAgKiBk ZmcvREZHQ2xvYmJlcml6ZS5oOgorICAgICAgICAoSlNDOjpERkc6OmNsb2JiZXJpemUpOgorCiAy MDE2LTA5LTMwICBKb3NlcGggUGVjb3Jhcm8gIDxwZWNvcmFyb0BhcHBsZS5jb20+CiAKICAgICAg ICAgRml4IG1vZHVsZXMgdGVzdHMgYWZ0ZXIgcjIwNjY1MyBoYW5kbGUgYnJlYWtwb2ludCBsb2Nh dGlvbnMgaW4gaW1wb3J0L2V4cG9ydCBzdGF0ZW1lbnRzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlw dENvcmUvZGZnL0RGR0Nsb2JiZXJpemUuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlw dENvcmUvZGZnL0RGR0Nsb2JiZXJpemUuaAkocmV2aXNpb24gMjA2NjQzKQorKysgU291cmNlL0ph dmFTY3JpcHRDb3JlL2RmZy9ERkdDbG9iYmVyaXplLmgJKHdvcmtpbmcgY29weSkKQEAgLTI1OSw4 ICsyNTksMTMgQEAgdm9pZCBjbG9iYmVyaXplKEdyYXBoJiBncmFwaCwgTm9kZSogbm9kZQogICAg IH0KIAogICAgIGNhc2UgSGFzSW5kZXhlZFByb3BlcnR5OiB7Ci0gICAgICAgIHJlYWQoSlNPYmpl Y3RfYnV0dGVyZmx5KTsKICAgICAgICAgQXJyYXlNb2RlIG1vZGUgPSBub2RlLT5hcnJheU1vZGUo KTsKKyAgICAgICAgaWYgKG1vZGUudHlwZSgpID09IEFycmF5OjpGb3JjZUV4aXQpIHsKKyAgICAg ICAgICAgIHdyaXRlKFNpZGVTdGF0ZSk7CisgICAgICAgICAgICByZXR1cm47CisgICAgICAgIH0K KworICAgICAgICByZWFkKEpTT2JqZWN0X2J1dHRlcmZseSk7CiAgICAgICAgIHN3aXRjaCAobW9k ZS50eXBlKCkpIHsKICAgICAgICAgY2FzZSBBcnJheTo6SW50MzI6IHsKICAgICAgICAgICAgIGlm IChtb2RlLmlzSW5Cb3VuZHMoKSkgewo= 290397 2016-09-30 15:15:03 -0700 2016-10-08 11:34:44 -0700 patch for landing c-backup.diff text/plain 1531 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA2Njc5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE2LTA5LTMwICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IEhhc0luZGV4ZWRQcm9wZXJ0eSBjbG9iYmVyaXplIHJ1bGUgaXMgd3JvbmcgZm9yIEFycmF5OjpG b3JjZU9TUkV4aXQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTE1OTk0MgorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjczMjg4MzY+CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgRmlsaXAgUGl6bG8uCisKKyAgICAgICAgV2hlbiBIYXNJbmRleGVkUHJvcGVy dHkgaGFzIGEgRm9yY2VPU1JFeGl0IGFycmF5IG1vZGUsIGl0IHNob3VsZAorICAgICAgICByZXBv cnQgdG8gd3JpdGUgdG8gc2lkZSBzdGF0ZSwgbGlrZSB0aGUgRm9yY2VPU1JFeGl0IG5vZGUsIGFu ZCB0aGUKKyAgICAgICAgb3RoZXIgbm9kZXMgd2l0aCBGb3JjZU9TUkV4aXQgYXJyYXkgbW9kZS4K KworICAgICAgICAqIGRmZy9ERkdDbG9iYmVyaXplLmg6CisgICAgICAgIChKU0M6OkRGRzo6Y2xv YmJlcml6ZSk6CisKIDIwMTYtMDktMzAgIEpvc2VwaCBQZWNvcmFybyAgPHBlY29yYXJvQGFwcGxl LmNvbT4KIAogICAgICAgICBGaXggbW9kdWxlcyB0ZXN0cyBhZnRlciByMjA2NjUzIGhhbmRsZSBi cmVha3BvaW50IGxvY2F0aW9ucyBpbiBpbXBvcnQvZXhwb3J0IHN0YXRlbWVudHMKSW5kZXg6IFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ2xvYmJlcml6ZS5oCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ2xvYmJlcml6ZS5oCShyZXZpc2lvbiAyMDY2NDMp CisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Nsb2JiZXJpemUuaAkod29ya2luZyBj b3B5KQpAQCAtMjYyLDYgKzI2MiwxMCBAQCB2b2lkIGNsb2JiZXJpemUoR3JhcGgmIGdyYXBoLCBO b2RlKiBub2RlCiAgICAgICAgIHJlYWQoSlNPYmplY3RfYnV0dGVyZmx5KTsKICAgICAgICAgQXJy YXlNb2RlIG1vZGUgPSBub2RlLT5hcnJheU1vZGUoKTsKICAgICAgICAgc3dpdGNoIChtb2RlLnR5 cGUoKSkgeworICAgICAgICBjYXNlIEFycmF5OjpGb3JjZUV4aXQ6IHsKKyAgICAgICAgICAgIHdy aXRlKFNpZGVTdGF0ZSk7CisgICAgICAgICAgICByZXR1cm47CisgICAgICAgIH0KICAgICAgICAg Y2FzZSBBcnJheTo6SW50MzI6IHsKICAgICAgICAgICAgIGlmIChtb2RlLmlzSW5Cb3VuZHMoKSkg ewogICAgICAgICAgICAgICAgIHJlYWQoQnV0dGVyZmx5X3B1YmxpY0xlbmd0aCk7Cg==