232753 2021-11-05 05:08:49 -0700 in_by_val should not constant fold to in_by_id when the property is a property index 2021-11-10 10:56:34 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build PC Linux RESOLVED FIXED InRadar P2 Normal --- 1 lukas.bernhard saam ews-watchlist keith_miller lukas.bernhard mark.lam msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1812107 0 lukas.bernhard 2021-11-05 05:08:49 -0700 During differential testing of webkit I found a sample triggering a miscomputation in FTL related to evaluating the "in" statement in an async context. The sample is invoked as: WebKitBuild/Release/bin/jsc --validateOptions=true --useConcurrentJIT=false --useConcurrentGC=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --useFTLJIT=true sample.js function main() { let v249; let v205 = "abc".repeat(18) + "\n" + `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaabbbbbbbbbbbbbbbaaaaa aa setFloat64(v190,v191,aa92) a bbbbaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaanaaaaaaaaaaaaaa baaaaabbbaaaaanaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1` for (const v223 of v205) { const v232 = {}; v232[v223] = "n"; async function v244() { v249 = "1" in v232; } const v252 = v244(); } print(v249); // prints true in FTL (an spidermonkey), false in baseline } main(); 1812655 1 saam 2021-11-08 09:40:54 -0800 I can't reproduce this on a release build of r285408. Can you still reproduce it? 1812914 2 saam 2021-11-08 16:18:32 -0800 (In reply to Saam Barati from comment #1) > I can't reproduce this on a release build of r285408. Can you still > reproduce it? I might have been running this incorrectly. Will check again shortly. 1812944 3 saam 2021-11-08 17:26:07 -0800 (In reply to Saam Barati from comment #2) > (In reply to Saam Barati from comment #1) > > I can't reproduce this on a release build of r285408. Can you still > > reproduce it? > > I might have been running this incorrectly. Will check again shortly. Ok, I really can't reproduce this one. 1813012 4 lukas.bernhard 2021-11-09 00:19:59 -0800 The minimized sample I posted earlier indeed does not reproduce; however the original finding still reproduces and I created another reproducer: JSC on git commit: 016f88c15b9bf0ebae0090babdad6a34e783d1b5 Build options: ./Tools/Scripts/build-jsc --jsc-only --release --cmakeargs="-ENABLE_STATIC_JSC=ON -DCMAKE_C_COMPILER='/usr/bin/clang-12' -DCMAKE_CXX_COMPILER='/usr/bin/clang++-12' -DCMAKE_CXX_FLAGS='-fsanitize-coverage=trace-pc-guard -O3 -lrt -fuse-ld=lld'" Command line: WebKitBuild/Release/bin/jsc --validateOptions=true --useConcurrentJIT=false --useConcurrentGC=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --useFTLJIT=true sample.js sha256sum of sample.js: c849be88c2824d47b51ef1f2283ed4ab034dd3789b7a184bff1e008f73d1ae1c sample.js: ``` function main() { let v249; const v178 = []; v179 = class V179 { constructor(v181,v182,v183) { } }; const v195 = [v178,v179,1]; const v203 = {}; const v204 = [v179,v195]; const v205 = v204.toLocaleString(); for (const v223 of v205) { const v232 = {}; v232[v223] = "number"; async function v244() { v249 = "1" in v232; const v250 = 0; } const v252 = v244(); } print(v249); } main(); ``` 1813396 5 443751 saam 2021-11-09 16:21:17 -0800 Created attachment 443751 patch 1813397 6 443751 ysuzuki 2021-11-09 16:22:13 -0800 Comment on attachment 443751 patch r=me 1813705 7 ews-feeder 2021-11-10 10:55:07 -0800 Committed r285592 (244100@main): <https://commits.webkit.org/244100@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 443751. 1813706 8 webkit-bug-importer 2021-11-10 10:56:34 -0800 <rdar://problem/85261534> 443751 2021-11-09 16:21:17 -0800 2021-11-10 10:55:08 -0800 patch a-backup.diff text/plain 6008 saam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyODU1NDApCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE5IEBACisyMDIxLTExLTA5ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu Y29tPgorCisgICAgICAgIGluX2J5X3ZhbCBzaG91bGQgbm90IGNvbnN0YW50IGZvbGQgdG8gaW5f YnlfaWQgd2hlbiB0aGUgcHJvcGVydHkgaXMgYSBwcm9wZXJ0eSBpbmRleAorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjMyNzUzCisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3MvZG9udC1pbi1ieS1p ZC13aGVuLWluZGV4LTIuanM6IEFkZGVkLgorICAgICAgICAoYXNzZXJ0KToKKyAgICAgICAgKG1h aW4udjE3OSk6CisgICAgICAgIChtYWluLmFzeW5jIHYyNDQpOgorICAgICAgICAobWFpbik6Cisg ICAgICAgICogc3RyZXNzL2RvbnQtaW4tYnktaWQtd2hlbi1pbmRleC5qczogQWRkZWQuCisgICAg ICAgIChhc3NlcnQpOgorICAgICAgICAodGVzdCk6CisKIDIwMjEtMTEtMDkgIFNhYW0gQmFyYXRp ICA8c2JhcmF0aUBhcHBsZS5jb20+CiAKICAgICAgICAgV2hlbiBpbmxpbmluZyBOZXdTeW1ib2wg aW4gdGhlIERGRyBkb24ndCB1bml2ZXJzYWxseSBjYWxsIFRvU3RyaW5nIG9uIHRoZSBpbnB1dApJ bmRleDogSlNUZXN0cy9zdHJlc3MvZG9udC1pbi1ieS1pZC13aGVuLWluZGV4LTIuanMKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvZG9udC1pbi1ieS1pZC13aGVuLWluZGV4LTIuanMJKG5v bmV4aXN0ZW50KQorKysgSlNUZXN0cy9zdHJlc3MvZG9udC1pbi1ieS1pZC13aGVuLWluZGV4LTIu anMJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwzNyBAQAorLy9AIHJ1bkRlZmF1bHQoIi0tdmFs aWRhdGVPcHRpb25zPXRydWUiLCAiLS11c2VDb25jdXJyZW50SklUPWZhbHNlIiwgIi0tdXNlQ29u Y3VycmVudEdDPWZhbHNlIiwgIi0tdGhyZXNob2xkRm9ySklUU29vbj0xMCIsICItLXRocmVzaG9s ZEZvckpJVEFmdGVyV2FybVVwPTEwIiwgIi0tdGhyZXNob2xkRm9yT3B0aW1pemVBZnRlcldhcm1V cD0xMDAiLCAiLS10aHJlc2hvbGRGb3JPcHRpbWl6ZUFmdGVyTG9uZ1dhcm1VcD0xMDAiLCAiLS10 aHJlc2hvbGRGb3JPcHRpbWl6ZVNvb249MTAwIiwgIi0tdGhyZXNob2xkRm9yRlRMT3B0aW1pemVB ZnRlcldhcm1VcD0xMDAwIiwgIi0tdGhyZXNob2xkRm9yRlRMT3B0aW1pemVTb29uPTEwMDAiLCAi LS12YWxpZGF0ZUJDRT10cnVlIiwgIi0tdXNlRlRMSklUPTAiKQorCitmdW5jdGlvbiBhc3NlcnQo YikgeworICAgIGlmICghYikKKyAgICAgICAgdGhyb3cgbmV3IEVycm9yOworfQorCitmdW5jdGlv biBtYWluKCkgeworICAgIGxldCB2MjQ5OworCisgICAgY29uc3QgdjE3OCA9IFtdOworCisgICAg djE3OSA9IGNsYXNzIFYxNzkgeworICAgICAgICBjb25zdHJ1Y3Rvcih2MTgxLHYxODIsdjE4Mykg eworICAgICAgICB9CisgICAgfTsKKworICAgIGNvbnN0IHYxOTUgPSBbdjE3OCx2MTc5LDFdOwor ICAgIGNvbnN0IHYyMDMgPSB7fTsKKyAgICBjb25zdCB2MjA0ID0gW3YxNzksdjE5NV07CisgICAg Y29uc3QgdjIwNSA9IHYyMDQudG9Mb2NhbGVTdHJpbmcoKTsKKworICAgIGZvciAoY29uc3QgdjIy MyBvZiB2MjA1KSB7CisgICAgICAgIGNvbnN0IHYyMzIgPSB7fTsKKyAgICAgICAgdjIzMlt2MjIz XSA9ICJudW1iZXIiOworCisgICAgICAgIGFzeW5jIGZ1bmN0aW9uIHYyNDQoKSB7CisgICAgICAg ICAgICB2MjQ5ID0gIjEiIGluIHYyMzI7CisgICAgICAgICAgICBjb25zdCB2MjUwID0gMDsKKyAg ICAgICAgfQorICAgICAgICB2MjQ0KCk7CisgICAgfQorCisgICAgYXNzZXJ0KHYyNDkgPT09IHRy dWUpOworfQorCittYWluKCk7CkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9kb250LWluLWJ5LWlkLXdo ZW4taW5kZXguanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvZG9udC1pbi1ieS1pZC13 aGVuLWluZGV4LmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL2RvbnQtaW4tYnkt aWQtd2hlbi1pbmRleC5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDE1IEBACitmdW5jdGlv biBhc3NlcnQoYikgeworICAgIGlmICghYikKKyAgICAgICAgdGhyb3cgbmV3IEVycm9yOworfQor CitmdW5jdGlvbiB0ZXN0KG9iaikgeworICAgIHJldHVybiAiMSIgaW4gb2JqOworfQorbm9Jbmxp bmUodGVzdCk7CisKK2xldCBvID0gWzEwLCB7fV07CisKK2ZvciAobGV0IGkgPSAwOyBpIDwgMTAw MDA7ICsraSkgeworICAgIGFzc2VydCh0ZXN0KG8pID09PSB0cnVlKTsKK30KSW5kZXg6IFNvdXJj ZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3Jp cHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjg1NDA4KQorKysgU291cmNlL0phdmFTY3JpcHRD b3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDIxLTExLTA5 ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAgIGluX2J5X3ZhbCBz aG91bGQgbm90IGNvbnN0YW50IGZvbGQgdG8gaW5fYnlfaWQgd2hlbiB0aGUgcHJvcGVydHkgaXMg YSBwcm9wZXJ0eSBpbmRleAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MjMyNzUzCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgKiBkZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGluZXMuaDoKKyAgICAgICAg KEpTQzo6REZHOjpBYnN0cmFjdEludGVycHJldGVyPEFic3RyYWN0U3RhdGVUeXBlPjo6ZXhlY3V0 ZUVmZmVjdHMpOgorICAgICAgICAqIGRmZy9ERkdDb25zdGFudEZvbGRpbmdQaGFzZS5jcHA6Cisg ICAgICAgIChKU0M6OkRGRzo6Q29uc3RhbnRGb2xkaW5nUGhhc2U6OmZvbGRDb25zdGFudHMpOgor ICAgICAgICAqIGRmZy9ERkdWYWxpZGF0ZS5jcHA6CisKIDIwMjEtMTEtMDggIFNhYW0gQmFyYXRp ICA8c2JhcmF0aUBhcHBsZS5jb20+CiAKICAgICAgICAgV2UgbmVlZCB0byBQcmVmZXJOdW1iZXIg d2hlbiBjYWxsaW5nIHRvUHJpbWl0aXZlIGZvciBuZWdhdGUKSW5kZXg6IFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9kZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGluZXMuaAo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVz LmgJKHJldmlzaW9uIDI4NTQwOCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQWJz dHJhY3RJbnRlcnByZXRlcklubGluZXMuaAkod29ya2luZyBjb3B5KQpAQCAtNDI0Niw3ICs0MjQ2 LDcgQEAgYm9vbCBBYnN0cmFjdEludGVycHJldGVyPEFic3RyYWN0U3RhdGVUeQogICAgICAgICBp ZiAoSlNWYWx1ZSBjb25zdGFudCA9IHByb3BlcnR5LnZhbHVlKCkpIHsKICAgICAgICAgICAgIGlm IChjb25zdGFudC5pc1N0cmluZygpKSB7CiAgICAgICAgICAgICAgICAgSlNTdHJpbmcqIHN0cmlu ZyA9IGFzU3RyaW5nKGNvbnN0YW50KTsKLSAgICAgICAgICAgICAgICBpZiAoQ2FjaGVhYmxlSWRl bnRpZmllcjo6aXNDYWNoZWFibGVJZGVudGlmaWVyQ2VsbChzdHJpbmcpKQorICAgICAgICAgICAg ICAgIGlmIChDYWNoZWFibGVJZGVudGlmaWVyOjppc0NhY2hlYWJsZUlkZW50aWZpZXJDZWxsKHN0 cmluZykgJiYgIXBhcnNlSW5kZXgoQ2FjaGVhYmxlSWRlbnRpZmllcjo6Y3JlYXRlRnJvbUNlbGwo c3RyaW5nKS51aWQoKSkpCiAgICAgICAgICAgICAgICAgICAgIG1fc3RhdGUuc2V0U2hvdWxkVHJ5 Q29uc3RhbnRGb2xkaW5nKHRydWUpOwogICAgICAgICAgICAgfQogICAgICAgICB9CkluZGV4OiBT b3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NvbnN0YW50Rm9sZGluZ1BoYXNlLmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NvbnN0YW50Rm9sZGluZ1Bo YXNlLmNwcAkocmV2aXNpb24gMjg1NDA4KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9E RkdDb25zdGFudEZvbGRpbmdQaGFzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTY4MSw3ICs2ODEs NyBAQCBwcml2YXRlOgogICAgICAgICAgICAgICAgIGlmIChKU1ZhbHVlIGNvbnN0YW50ID0gcHJv cGVydHkudmFsdWUoKSkgewogICAgICAgICAgICAgICAgICAgICBpZiAoY29uc3RhbnQuaXNTdHJp bmcoKSkgewogICAgICAgICAgICAgICAgICAgICAgICAgSlNTdHJpbmcqIHN0cmluZyA9IGFzU3Ry aW5nKGNvbnN0YW50KTsKLSAgICAgICAgICAgICAgICAgICAgICAgIGlmIChDYWNoZWFibGVJZGVu dGlmaWVyOjppc0NhY2hlYWJsZUlkZW50aWZpZXJDZWxsKHN0cmluZykpIHsKKyAgICAgICAgICAg ICAgICAgICAgICAgIGlmIChDYWNoZWFibGVJZGVudGlmaWVyOjppc0NhY2hlYWJsZUlkZW50aWZp ZXJDZWxsKHN0cmluZykgJiYgIXBhcnNlSW5kZXgoQ2FjaGVhYmxlSWRlbnRpZmllcjo6Y3JlYXRl RnJvbUNlbGwoc3RyaW5nKS51aWQoKSkpIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICBj b25zdCBTdHJpbmdJbXBsKiBpbXBsID0gc3RyaW5nLT50cnlHZXRWYWx1ZUltcGwoKTsKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBSRUxFQVNFX0FTU0VSVChpbXBsKTsKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBtX2dyYXBoLmZyZWV6ZVN0cm9uZyhzdHJpbmcpOwpJbmRleDogU291 cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdWYWxpZGF0ZS5jcHAKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdWYWxpZGF0ZS5jcHAJKHJldmlzaW9uIDI4NTQwOCkK KysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHVmFsaWRhdGUuY3BwCSh3b3JraW5nIGNv cHkpCkBAIC0yOSw2ICsyOSw3IEBACiAjaWYgRU5BQkxFKERGR19KSVQpCiAKICNpbmNsdWRlICJC dXR0ZXJmbHlJbmxpbmVzLmgiCisjaW5jbHVkZSAiQ2FjaGVhYmxlSWRlbnRpZmllcklubGluZXMu aCIKICNpbmNsdWRlICJERkdDbG9iYmVyaXplLmgiCiAjaW5jbHVkZSAiREZHQ2xvYmJlcnNFeGl0 U3RhdGUuaCIKICNpbmNsdWRlICJERkdEb21pbmF0b3JzLmgiCkBAIC0yMzQsNiArMjM1LDExIEBA IHB1YmxpYzoKICAgICAgICAgICAgICAgICAgICAgaWYgKCFub2RlLT5jaGlsZDEoKSkKICAgICAg ICAgICAgICAgICAgICAgICAgIFZBTElEQVRFKChub2RlKSwgIW5vZGUtPmNoaWxkMigpKTsKICAg ICAgICAgICAgICAgICB9CisKKyAgICAgICAgICAgICAgICBpZiAobm9kZS0+aGFzQ2FjaGVhYmxl SWRlbnRpZmllcigpKSB7CisgICAgICAgICAgICAgICAgICAgIGF1dG8qIHVpZCA9IG5vZGUtPmNh Y2hlYWJsZUlkZW50aWZpZXIoKS51aWQoKTsKKyAgICAgICAgICAgICAgICAgICAgVkFMSURBVEUo KG5vZGUpLCAhcGFyc2VJbmRleCgqdWlkKSk7CisgICAgICAgICAgICAgICAgfQogICAgICAgICAg ICAgICAgICAKICAgICAgICAgICAgICAgICBzd2l0Y2ggKG5vZGUtPm9wKCkpIHsKICAgICAgICAg ICAgICAgICBjYXNlIElkZW50aXR5Ogo=