Bug 189757

Summary: AI rule for MultiPutByOffset executes its effects in the wrong order
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Severity: Normal CC: benjamin, commit-queue, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, webkit-bug-importer, ysuzuki, zhunkibatu
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
patch none

Description Saam Barati 2018-09-19 11:24:12 PDT
Look at this code:
        observeTransitions(clobberLimit, transitions);
        if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
        setForNode(node->child2(), resultingValue);
        if (!!originalValue && !resultingValue)

However, we first need to execute the last three lines before the first three lines. This is because that's how the execution of the node happens at runtime. This can lead to bad results when resultingValue is the same as the base, e.g:
o.f = o;
Comment 1 Saam Barati 2018-09-19 11:25:04 PDT
Comment 2 Saam Barati 2018-09-19 12:02:10 PDT
Created attachment 350139 [details]
Comment 3 Michael Saboff 2018-09-19 12:06:29 PDT
Comment on attachment 350139 [details]

Comment 4 WebKit Commit Bot 2018-09-19 14:00:15 PDT
Comment on attachment 350139 [details]

Clearing flags on attachment: 350139

Committed r236223: <https://trac.webkit.org/changeset/236223>
Comment 5 WebKit Commit Bot 2018-09-19 14:00:16 PDT
All reviewed patches have been landed.  Closing bug.
Comment 6 Mark Lam 2018-10-03 16:28:21 PDT
*** Bug 188694 has been marked as a duplicate of this bug. ***