Bug 186460 – [DFG][FTL] Spread onto PhantomNewArrayBuffer assumes JSFixedArray, but JSImmutableButterfly is returned

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Yusuke Suzuki]

Spread for phantom nodes generates JSFixedArray. So previously, our PhantomNewArrayBuffer returns a fixed array stored in this node. But now, it holds JSImmutableButterfly, but FTL lowering phase mixes JSFixedArray and JSImmutableButterfly.

I think we can generate JSImmutableButterfly instead of JSFixedArray in Spread.

[Yusuke Suzuki]

Created attachment 342801 [details]
Patch

[Saam Barati]

Comment on attachment 342801 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=342801&action=review

r=me

> Source/JavaScriptCore/ChangeLog:8
> +        Spread(PhantomNewArrayBuffer) returns JSImmutableButterfly. But it is wrong.

Do we do the right thing when we exit for PhantomSpread(PhantomNewArrayBuffer)?

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5718
> +            ValueFromBlock slowFixedArray = m_out.anchor(vmCall(Int64, m_out.operation(operationCreateFixedArray), m_callFrame, m_out.constInt32(immutableButterfly->length())));

IntPtr

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5722
> +            LValue fixedArray = m_out.phi(Int64, fastFixedArray, slowFixedArray);

IntPtr

[EWS Watchlist]

Comment on attachment 342801 [details]
Patch

Attachment 342801 [details] did not pass win-ews (win):
Output: http://webkit-queues.webkit.org/results/8200408

New failing tests:
http/tests/preload/onload_event.html

[EWS Watchlist]

Created attachment 342834 [details]
Archive of layout-test-results from ews202 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews202  Port: win-future  Platform: CYGWIN_NT-6.1-2.9.0-0.318-5-3-x86_64-64bit

[Yusuke Suzuki]

Comment on attachment 342801 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=342801&action=review

>> Source/JavaScriptCore/ChangeLog:8
>> +        Spread(PhantomNewArrayBuffer) returns JSImmutableButterfly. But it is wrong.
> 
> Do we do the right thing when we exit for PhantomSpread(PhantomNewArrayBuffer)?

Yeah, PhantomNewArrayBuffer generates an array from JSImmutableButterfly. And PhantomSread generates JSFixedArray from JSArray.

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5718
>> +            ValueFromBlock slowFixedArray = m_out.anchor(vmCall(Int64, m_out.operation(operationCreateFixedArray), m_callFrame, m_out.constInt32(immutableButterfly->length())));
> 
> IntPtr

Fixed.

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5722
>> +            LValue fixedArray = m_out.phi(Int64, fastFixedArray, slowFixedArray);
> 
> IntPtr

Fixed.

[Yusuke Suzuki]

Committed r232902: <https://trac.webkit.org/changeset/232902>

[Radar WebKit Bug Importer]

<rdar://problem/41186005>