Bug 189757

Summary:

AI rule for MultiPutByOffset executes its effects in the wrong order

Product:

WebKit

Reporter:

Saam Barati <saam>

Component:

JavaScriptCore

Assignee:

Saam Barati <saam>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, commit-queue, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, webkit-bug-importer, ysuzuki, zhunkibatu

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
patch	none

Saam Barati

Reported 2018-09-19 11:24:12 PDT

Look at this code: ``` observeTransitions(clobberLimit, transitions); if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction) m_state.setIsValid(false); setForNode(node->child2(), resultingValue); if (!!originalValue && !resultingValue) m_state.setIsValid(false); ``` However, we first need to execute the last three lines before the first three lines. This is because that's how the execution of the node happens at runtime. This can lead to bad results when resultingValue is the same as the base, e.g: ``` o.f = o; ```

Attachments
patch (3.92 KB, patch) 2018-09-19 12:02 PDT, Saam Barati	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.