161492 2016-09-01 10:39:37 -0700 ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases 2016-09-01 11:58:54 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 143073 160125 1 fpizlo fpizlo commit-queue keith_miller mark.lam msaboff saam webkit-bug-importer oldest_to_newest 1225383 0 fpizlo 2016-09-01 10:39:37 -0700 This seems to cause trouble: a: CreateActivation() MovHint(@a, loc1) b: NewFunction(@a) MovHint(@b, loc2) c: NewFunction(@b) MovHint(@c, loc3) Escape(@b) I'm seeing code like this: a: PhantomCreateActivation() MovHint(@a, loc1) b: PhantomNewFunction(@a) PutHint(@b, @a, scope) MovHint(@b, loc2) c: PhantomNewFunction(@b) PutHint(@c, @a, scope) MovHint(@c, loc3) d: MaterializeCreateActivation() e: NewFunction(@d) MovHint(@d, loc1) MovHint(@e, loc2) Escape(@e) But this is wrong, because if we exit, then we will recreate @c pointing at a newly materialized activation, rather than at @d. In other words, the phase should have produced this code instead: a: PhantomCreateActivation() MovHint(@a, loc1) b: PhantomNewFunction(@a) PutHint(@b, @a, scope) MovHint(@b, loc2) c: PhantomNewFunction(@b) PutHint(@c, @a, scope) MovHint(@c, loc3) d: MaterializeCreateActivation() e: NewFunction(@d) PutHint(@c, @e, scope) <---- THIS MovHint(@d, loc1) MovHint(@e, loc2) Escape(@e) The phase seems to have code to do this. I'm still investigating what goes wrong. 1225410 1 fpizlo 2016-09-01 11:12:33 -0700 It looks like this is handled by m_materializationSiteToRecoveries. I wonder why the scope isn't in there. 1225414 2 fpizlo 2016-09-01 11:18:10 -0700 100% repro: function bar() { } noInline(bar); function foo(p, x) { var value = 1; function inc() { return value + 1; } function dec() { return value - 1; } if (!p) return 0; bar(inc); x += 2000000000; value = 42; return dec(); } noInline(foo); function test(x) { var result = foo(true, x); if (result != 42 - 1) throw "Error: bad result: " + result; } for (var i = 0; i < 100000; ++i) test(0); test(2000000000); 1225430 3 fpizlo 2016-09-01 11:42:51 -0700 Wow this is an epic one-line fix! 1225434 4 287648 fpizlo 2016-09-01 11:48:31 -0700 Created attachment 287648 the patch 1225436 5 287648 mark.lam 2016-09-01 11:55:13 -0700 Comment on attachment 287648 the patch View in context: https://bugs.webkit.org/attachment.cgi?id=287648&action=review r=me > Source/JavaScriptCore/ChangeLog:16 > + it's a special meta-data field initialed on construction. But just because it's immutable /initialed/initialized/ ? > Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:1942 > - > + Please remove. 1225438 6 fpizlo 2016-09-01 11:56:17 -0700 (In reply to comment #5) > Comment on attachment 287648 [details] > the patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=287648&action=review > > r=me > > > Source/JavaScriptCore/ChangeLog:16 > > + it's a special meta-data field initialed on construction. But just because it's immutable > > /initialed/initialized/ ? Fixed. > > > Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:1942 > > - > > + > > Please remove. Fixed. 1225441 7 fpizlo 2016-09-01 11:58:01 -0700 Landed in http://trac.webkit.org/changeset/205304 1225442 8 webkit-bug-importer 2016-09-01 11:58:54 -0700 <rdar://problem/28120011> 287648 2016-09-01 11:48:31 -0700 2016-09-01 11:55:13 -0700 the patch blah.patch text/plain 6985 fpizlo SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMDUzMDIpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDI1IEBACisyMDE2LTA5LTAxICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5j b20+CisKKyAgICAgICAgT2JqZWN0QWxsb2NhdGlvblNpbmtpbmdQaGFzZTo6aW5zZXJ0T1NSSGlu dHNGb3JVcGRhdGUoKSBmYWlscyB0byBlbWl0IHVwZGF0ZWQgaGludHMgaW4gc29tZSBjYXNlcwor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTYxNDkyCisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisgICAgICAgIAorICAgICAgICBU aGlzIGJ1ZyBhZmZlY3RlZCBmdW5jdGlvbi0+YWN0aXZhdGlvbiByZWZlcmVuY2VzIGJ1dCBub3Qg b2JqZWN0LT5vYmplY3QgZmllbGQgcmVmZXJlbmNlcywKKyAgICAgICAgYmVjYXVzZSBvYmplY3Qt Pm9iamVjdCBmaWVsZCByZWZlcmVuY2VzIGFyZSAhbmVlZGVkRm9yTWF0ZXJpYWxpemF0aW9uKCku IFNvLCB0aGUgb2JqZWN0CisgICAgICAgIHRlc3QgYWx3YXlzIHBhc3NlZCBidXQgdGhlIGFjdGl2 YXRpb24vZnVuY3Rpb24gdGVzdCB1c2VkIHRvIGFsd2F5cyBmYWlsLiBJdCBwYXNzZXMgbm93Lgor CisgICAgICAgICogc3RyZXNzL21hdGVyaWFsaXplLWFjdGl2YXRpb24tcmVmZXJlbmNlZC1mcm9t LXBoYW50b20tZnVuY3Rpb24uanM6IEFkZGVkLgorICAgICAgICAoYmFyKToKKyAgICAgICAgKGlu Yyk6CisgICAgICAgIChkZWMpOgorICAgICAgICAoZm9vKToKKyAgICAgICAgKHRlc3QpOgorICAg ICAgICAqIHN0cmVzcy9tYXRlcmlhbGl6ZS1vYmplY3QtcmVmZXJlbmNlZC1mcm9tLXBoYW50b20t b2JqZWN0LmpzOiBBZGRlZC4KKyAgICAgICAgKGJhcik6CisgICAgICAgIChmb28pOgorICAgICAg ICAodGVzdCk6CisKIDIwMTYtMDgtMzEgIFl1c3VrZSBTdXp1a2kgIDx1dGF0YW5lLnRlYUBnbWFp bC5jb20+CiAKICAgICAgICAgc3RyZXNzL3JhbmRvbS01M2JpdC5qcy5mdGwtbm8tY2ppdC1uby1p bmxpbmUtdmFsaWRhdGUgc29tZXRpbWVzIGZhaWxzCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9tYXRl cmlhbGl6ZS1hY3RpdmF0aW9uLXJlZmVyZW5jZWQtZnJvbS1waGFudG9tLWZ1bmN0aW9uLmpzCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIEpTVGVzdHMvc3RyZXNzL21hdGVyaWFsaXplLWFjdGl2YXRpb24tcmVmZXJl bmNlZC1mcm9tLXBoYW50b20tZnVuY3Rpb24uanMJKG5vbmV4aXN0ZW50KQorKysgSlNUZXN0cy9z dHJlc3MvbWF0ZXJpYWxpemUtYWN0aXZhdGlvbi1yZWZlcmVuY2VkLWZyb20tcGhhbnRvbS1mdW5j dGlvbi5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDQyIEBACitmdW5jdGlvbiBiYXIoKQor eworfQorCitub0lubGluZShiYXIpOworCitmdW5jdGlvbiBmb28ocCwgeCkKK3sKKyAgICB2YXIg dmFsdWUgPSAxOworICAgIGZ1bmN0aW9uIGluYygpCisgICAgeworICAgICAgICByZXR1cm4gdmFs dWUgKyAxOworICAgIH0KKyAgICBmdW5jdGlvbiBkZWMoKQorICAgIHsKKyAgICAgICAgcmV0dXJu IHZhbHVlIC0gMTsKKyAgICB9CisgICAgCisgICAgaWYgKCFwKQorICAgICAgICByZXR1cm4gMDsK KyAgICAKKyAgICBiYXIoaW5jKTsKKyAgICAKKyAgICB4ICs9IDIwMDAwMDAwMDA7CisgICAgCisg ICAgdmFsdWUgPSA0MjsKKyAgICByZXR1cm4gZGVjKCk7Cit9CisKK25vSW5saW5lKGZvbyk7CisK K2Z1bmN0aW9uIHRlc3QoeCkKK3sKKyAgICB2YXIgcmVzdWx0ID0gZm9vKHRydWUsIHgpOworICAg IGlmIChyZXN1bHQgIT0gNDIgLSAxKQorICAgICAgICB0aHJvdyAiRXJyb3I6IGJhZCByZXN1bHQ6 ICIgKyByZXN1bHQ7Cit9CisKK2ZvciAodmFyIGkgPSAwOyBpIDwgMTAwMDAwOyArK2kpCisgICAg dGVzdCgwKTsKKwordGVzdCgyMDAwMDAwMDAwKTsKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL21hdGVy aWFsaXplLW9iamVjdC1yZWZlcmVuY2VkLWZyb20tcGhhbnRvbS1vYmplY3QuanMKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gSlNUZXN0cy9zdHJlc3MvbWF0ZXJpYWxpemUtb2JqZWN0LXJlZmVyZW5jZWQtZnJvbS1w aGFudG9tLW9iamVjdC5qcwkobm9uZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVzcy9tYXRlcmlh bGl6ZS1vYmplY3QtcmVmZXJlbmNlZC1mcm9tLXBoYW50b20tb2JqZWN0LmpzCSh3b3JraW5nIGNv cHkpCkBAIC0wLDAgKzEsMzcgQEAKK2Z1bmN0aW9uIGJhcigpCit7Cit9CisKK25vSW5saW5lKGJh cik7CisKK2Z1bmN0aW9uIGZvbyhwLCB4KQoreworICAgIHZhciBhID0ge2Y6IDF9OworICAgIHZh ciBiID0ge2Y6IGF9OworICAgIHZhciBjID0ge2Y6IGF9OworICAgIAorICAgIGlmICghcCkKKyAg ICAgICAgcmV0dXJuIDA7CisgICAgCisgICAgYmFyKGIpOworICAgIAorICAgIHggKz0gMjAwMDAw MDAwMDsKKyAgICAKKyAgICBjLmYuZiA9IDQyOworICAgIHJldHVybiBiLmYuZjsKK30KKworbm9J bmxpbmUoZm9vKTsKKworZnVuY3Rpb24gdGVzdCh4KQoreworICAgIHZhciByZXN1bHQgPSBmb28o dHJ1ZSwgeCk7CisgICAgaWYgKHJlc3VsdCAhPSA0MikKKyAgICAgICAgdGhyb3cgIkVycm9yOiBi YWQgcmVzdWx0OiAiICsgcmVzdWx0OworfQorCitmb3IgKHZhciBpID0gMDsgaSA8IDEwMDAwMDsg KytpKQorICAgIHRlc3QoMCk7CisKK3Rlc3QoMjAwMDAwMDAwMCk7CisKSW5kZXg6IFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRD b3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA1MjkzKQorKysgU291cmNlL0phdmFTY3JpcHRDb3Jl L0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI1IEBACisyMDE2LTA5LTAxICBG aWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAgT2JqZWN0QWxsb2NhdGlv blNpbmtpbmdQaGFzZTo6aW5zZXJ0T1NSSGludHNGb3JVcGRhdGUoKSBmYWlscyB0byBlbWl0IHVw ZGF0ZWQgaGludHMgaW4gc29tZSBjYXNlcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTYxNDkyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisgICAgICAgIAorICAgICAgICBJZiB5b3UgbWF0ZXJpYWxpemUgYSBzdW5rZW4gb2Jq ZWN0IHRoYXQgaXMgcmVmZXJlbmNlZCBmcm9tIGFub3RoZXIgc3Vua2VuIG9iamVjdCwgdGhlbiB5 b3UKKyAgICAgICAgaGF2ZSB0byBlbWl0IGEgUHV0SGludCB0byB0ZWxsIE9TUiB0aGF0IHRoZSBs YXR0ZXIgb2JqZWN0IG5vdyByZWZlcnMgdG8gYSBtYXRlcmlhbGl6ZWQKKyAgICAgICAgb2JqZWN0 IHJhdGhlciB0aGFuIHRvIHRoZSBvbGQgc3Vua2VuIG9uZS4KKyAgICAgICAgCisgICAgICAgIFRo ZSBPYmplY3RBbGxvY2F0aW9uU2lua2luZ1BoYXNlIHRvdGFsbHkga25vd3MgaG93IHRvIGRvIHRo aXMsIGJ1dCBmb3Igc29tZSByZWFzb24gaXQgb25seQorICAgICAgICBkaWQgaXQgd2hlbiB0aGUg UHJvbW90ZWRMb2NhdGlvbkRlc2NyaXB0b3IgZm9yIHRoZSBmaWVsZCB1c2VkIGZvciByZWZlcnJp bmcgdG8gdGhlIG90aGVyCisgICAgICAgIG9iamVjdCBpcyAhbmVlZGVkRm9yTWF0ZXJpYWxpemF0 aW9uKCksIGkuZS4gaXQncyBhIE5hbWVkUHJvcGVydHlQTG9jIG9yIGEgQ2xvc3VyZVZhclBMb2Mu CisgICAgICAgIEkgY2FuIHNvcnQgb2YgaW1hZ2luZSB3aHkgd2UgdGhvdWdodCB0aGF0IHdvdWxk IGJlIHJpZ2h0IC0gbmVlZGVkRm9yTWF0ZXJpYWxpemF0aW9uKCkgbWVhbnMKKyAgICAgICAgaXQn cyBhIHNwZWNpYWwgbWV0YS1kYXRhIGZpZWxkIGluaXRpYWxlZCBvbiBjb25zdHJ1Y3Rpb24uIEJ1 dCBqdXN0IGJlY2F1c2UgaXQncyBpbW11dGFibGUKKyAgICAgICAgYW5kIHNwZWNpYWwgZG9lc24n dCBtZWFuIHRoYXQgbWF0ZXJpYWxpemF0aW9uIGNhbid0IGNoYW5nZSBpdHMgcGh5c2ljYWwgcmVw cmVzZW50YXRpb24uCisgICAgICAgIFJlbW92aW5nIHRoZSByZXF1aXJlbWVudCB0aGF0IGl0J3Mg IW5lZWRlZEZvck1hdGVyaWFsaXphdGlvbigpIGZpeGVzIHRoZSB0ZXN0IGFuZCBkb2Vzbid0Cisg ICAgICAgIHJlZ3Jlc3MgYW55dGhpbmcuCisKKyAgICAgICAgKiBkZmcvREZHT2JqZWN0QWxsb2Nh dGlvblNpbmtpbmdQaGFzZS5jcHA6CisKIDIwMTYtMDktMDEgIENzYWJhIE9zenRyb2dvbsOhYyAg PG9zc3lAd2Via2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkIEFSTSBidWlsZGZpeCBhZnRl ciByMjA1MjgzLgpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdPYmplY3RBbGxv Y2F0aW9uU2lua2luZ1BoYXNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENv cmUvZGZnL0RGR09iamVjdEFsbG9jYXRpb25TaW5raW5nUGhhc2UuY3BwCShyZXZpc2lvbiAyMDUy OTMpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR09iamVjdEFsbG9jYXRpb25TaW5r aW5nUGhhc2UuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMjQyLDcgKzEyNDIsNyBAQCBwcml2YXRl OgogCiAgICAgICAgICAgICBmb3IgKGNvbnN0IGF1dG8mIGZpZWxkIDogZW50cnkudmFsdWUuZmll bGRzKCkpIHsKICAgICAgICAgICAgICAgICBBU1NFUlQobV9zaW5rQ2FuZGlkYXRlcy5jb250YWlu cyhlbnRyeS5rZXkpIHx8ICFlc2NhcGVlcy5jb250YWlucyhmaWVsZC52YWx1ZSkpOwotICAgICAg ICAgICAgICAgIGlmIChlc2NhcGVlcy5jb250YWlucyhmaWVsZC52YWx1ZSkgJiYgIWZpZWxkLmtl eS5uZWVkZWRGb3JNYXRlcmlhbGl6YXRpb24oKSkKKyAgICAgICAgICAgICAgICBpZiAoZXNjYXBl ZXMuY29udGFpbnMoZmllbGQudmFsdWUpKQogICAgICAgICAgICAgICAgICAgICBoaW50cy5hcHBl bmQoUHJvbW90ZWRIZWFwTG9jYXRpb24oZW50cnkua2V5LCBmaWVsZC5rZXkpKTsKICAgICAgICAg ICAgIH0KICAgICAgICAgfQpAQCAtMTY5Miw2ICsxNjkyLDggQEAgcHJpdmF0ZToKICAgICAgICAg ICAgICAgICAgICAgbV9sb2NhbE1hcHBpbmcuc2V0KGxvY2F0aW9uLCBtX2JvdHRvbSk7CiAKICAg ICAgICAgICAgICAgICAgICAgaWYgKG1fc2lua0NhbmRpZGF0ZXMuY29udGFpbnMobm9kZSkpIHsK KyAgICAgICAgICAgICAgICAgICAgICAgIGlmICh2ZXJib3NlKQorICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGRhdGFMb2coIkZvciBzaW5rIGNhbmRpZGF0ZSAiLCBub2RlLCAiIGZvdW5kIGxv Y2F0aW9uICIsIGxvY2F0aW9uLCAiXG4iKTsKICAgICAgICAgICAgICAgICAgICAgICAgIG1faW5z ZXJ0aW9uU2V0Lmluc2VydCgKICAgICAgICAgICAgICAgICAgICAgICAgICAgICBub2RlSW5kZXgg KyAxLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxvY2F0aW9uLmNyZWF0ZUhpbnQoCkBA IC0xNzU4LDYgKzE3NjAsOCBAQCBwcml2YXRlOgogCiAgICAgICAgICAgICAgICAgICAgICAgICBk b0xvd2VyID0gdHJ1ZTsKIAorICAgICAgICAgICAgICAgICAgICAgICAgaWYgKHZlcmJvc2UpCisg ICAgICAgICAgICAgICAgICAgICAgICAgICAgZGF0YUxvZygiQ3JlYXRpbmcgaGludCB3aXRoIHZh bHVlICIsIG5vZGVWYWx1ZSwgIiBiZWZvcmUgIiwgbm9kZSwgIlxuIik7CiAgICAgICAgICAgICAg ICAgICAgICAgICBtX2luc2VydGlvblNldC5pbnNlcnQoCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgbm9kZUluZGV4ICsgMSwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsb2NhdGlv bi5jcmVhdGVIaW50KApAQCAtMTg5Myw2ICsxODk3LDEzIEBAIHByaXZhdGU6CiAKICAgICB2b2lk IGluc2VydE9TUkhpbnRzRm9yVXBkYXRlKHVuc2lnbmVkIG5vZGVJbmRleCwgTm9kZU9yaWdpbiBv cmlnaW4sIGJvb2wmIGNhbkV4aXQsIEF2YWlsYWJpbGl0eU1hcCYgYXZhaWxhYmlsaXR5LCBOb2Rl KiBlc2NhcGVlLCBOb2RlKiBtYXRlcmlhbGl6YXRpb24pCiAgICAgeworICAgICAgICBpZiAodmVy Ym9zZSkgeworICAgICAgICAgICAgZGF0YUxvZygiSW5zZXJ0aW5nIE9TUiBoaW50cyBhdCAiLCBv cmlnaW4sICI6XG4iKTsKKyAgICAgICAgICAgIGRhdGFMb2coIiAgICBFc2NhcGVlOiAiLCBlc2Nh cGVlLCAiXG4iKTsKKyAgICAgICAgICAgIGRhdGFMb2coIiAgICBNYXRlcmlhbGl6YXRpb246ICIs IG1hdGVyaWFsaXphdGlvbiwgIlxuIik7CisgICAgICAgICAgICBkYXRhTG9nKCIgICAgQXZhaWxh YmlsaXR5OiAiLCBhdmFpbGFiaWxpdHksICJcbiIpOworICAgICAgICB9CisgICAgICAgIAogICAg ICAgICAvLyBXZSBuZWVkIHRvIGZvbGxvdygpIHRoZSB2YWx1ZSBpbiB0aGUgaGVhcC4KICAgICAg ICAgLy8gQ29uc2lkZXIgdGhlIGZvbGxvd2luZyBncmFwaDoKICAgICAgICAgLy8KQEAgLTE5Mjgs NyArMTkzOSw3IEBAIHByaXZhdGU6CiAgICAgICAgICAgICAgICAgbm9kZUluZGV4LAogICAgICAg ICAgICAgICAgIGVudHJ5LmtleS5jcmVhdGVIaW50KG1fZ3JhcGgsIG9yaWdpbi50YWtlVmFsaWRF eGl0KGNhbkV4aXQpLCBtYXRlcmlhbGl6YXRpb24pKTsKICAgICAgICAgfQotCisgICAgICAgIAog ICAgICAgICBmb3IgKHVuc2lnbmVkIGkgPSBhdmFpbGFiaWxpdHkubV9sb2NhbHMuc2l6ZSgpOyBp LS07KSB7CiAgICAgICAgICAgICBpZiAoIWF2YWlsYWJpbGl0eS5tX2xvY2Fsc1tpXS5oYXNOb2Rl KCkpCiAgICAgICAgICAgICAgICAgY29udGludWU7Cg==