Bug 193413

Summary: [JSC] AI should check the given constant's array type when folding GetByVal into constant
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch keith_miller: review+

Yusuke Suzuki
Reported 2019-01-14 15:24:10 PST
GetByVal has Double ArrayModes. So it expects to get Double arrays, and it will genetate a double value. To ensure that, we have CheckStructure / CheckArray before this GetByVal. But in AI phase, CheckStructure and CheckArray would not perform anything on a proven abstract value. In that case, our GetByVal in AI gets unexpected array. If we do not perform any checks before using that to fold GetByVal into a constant, we have a bad time. 1: JSConstant(Array with CopyOnWrite | Contiguous) => like, ["bad"] 2: CheckStructure(@1, Array CopyOnWrite | Double) => It finally becomes OSR exit, but now, AI is not sure about it. 3: GetButterfly(@1) 4: GetByVal(@1, 0, @3, Array CopyOnWrite | Double) => If @4 can retrieve "bad" from @1, we attempt to convert @4 into "bad", but it is not acceptable since GetByVal(Double shape) should return a Double result. We should perform array check on @1 constant before performing constant folding in AI.
Attachments
Patch (7.98 KB, patch)
2019-01-14 16:45 PST, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Patch (8.35 KB, patch)
2019-01-14 16:49 PST, Yusuke Suzuki 		keith_miller: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2019-01-14 15:25:34 PST
<rdar://problem/46092389>
Yusuke Suzuki
Comment 2 2019-01-14 16:45:35 PST
Created attachment 359098 [details] Patch
Yusuke Suzuki
Comment 3 2019-01-14 16:49:28 PST
Created attachment 359099 [details] Patch
Keith Miller
Comment 4 2019-01-14 17:12:39 PST
Comment on attachment 359099 [details] Patch r=me.
Yusuke Suzuki
Comment 5 2019-01-14 17:26:49 PST
Committed r239964: <https://trac.webkit.org/changeset/239964>
Note You need to log in before you can comment on or make changes to this bug.