Bug 134056 – [ftlopt] LICM should be able to hoist CheckStructure even if the loop clobbers structures so long as the structures being checked are watchable

• Component: JavaScriptCore
• Status: RESOLVED INVALID

[Filip Pizlo]

Patch forthcoming.

[Filip Pizlo]

Created attachment 233349 [details]
the patch

[Filip Pizlo]

Comment on attachment 233349 [details]
the patch

This is totally wrong.

[Filip Pizlo]

It's not right to hoist a CheckStructure just because the structure is watchable.  Consider a loop like:

var o = ...; // when assigned here, o does not have a field f.
for (;;) {
    if (p1)
        o.f = 42; // adds a field f
    if (p2) // p2 becomes true only after p1 had become true
        ... = o.f; // say that after adding a field f to o, we won't add any more things to o, so the CheckStructure here will be on a watchable structure set.
}

If we hoist the CheckStructure then the CheckStructure will be sure to fail.  Therefore, the rules on the hoistability of CheckStructures need to be substantially more subtle.  In the example above, at a minimum we need to have some profiling of the type that o has at the loop pre-header to make sure that hoisting the CheckStructure to that location won't be guaranteed to fail.