Bug 195721 – DFG::AbstractValue::validateOSREntry is wrong when isHeapTop and the incoming value is Empty

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

```
    bool validate(JSValue value) const
    {
        if (isHeapTop())
            return true;
```

However, JSValue() is not part of heap top, but would return true if asked to validate on an AbstractValue that isHeapTop().

[Filip Pizlo]

(In reply to Saam Barati from comment #0)
> ```
>     bool validate(JSValue value) const
>     {
>         if (isHeapTop())
>             return true;
> ```
> 
> However, JSValue() is not part of heap top, but would return true if asked
> to validate on an AbstractValue that isHeapTop().

JSValue() in AbstractValue means that the value is “any JSValue”. There is no way to reflect folding to JSValue() in abstract value.

[Saam Barati]

(In reply to Filip Pizlo from comment #1)
> (In reply to Saam Barati from comment #0)
> > ```
> >     bool validate(JSValue value) const
> >     {
> >         if (isHeapTop())
> >             return true;
> > ```
> > 
> > However, JSValue() is not part of heap top, but would return true if asked
> > to validate on an AbstractValue that isHeapTop().
> 
> JSValue() in AbstractValue means that the value is “any JSValue”. There is
> no way to reflect folding to JSValue() in abstract value.

The scenario I'm worried about is OSR entry.

Let's say that this AbstractValue has type SpecHeapTop (and top for all the other things too). Let's say we deleted a CheckTDZ because we saw the type is SpecHeapTop. Let's also say that we're now OSR entering with the TDZ value (JSValue()). I think that would lead to a bug.

[Filip Pizlo]

(In reply to Saam Barati from comment #2)
> (In reply to Filip Pizlo from comment #1)
> > (In reply to Saam Barati from comment #0)
> > > ```
> > >     bool validate(JSValue value) const
> > >     {
> > >         if (isHeapTop())
> > >             return true;
> > > ```
> > > 
> > > However, JSValue() is not part of heap top, but would return true if asked
> > > to validate on an AbstractValue that isHeapTop().
> > 
> > JSValue() in AbstractValue means that the value is “any JSValue”. There is
> > no way to reflect folding to JSValue() in abstract value.
> 
> The scenario I'm worried about is OSR entry.
> 
> Let's say that this AbstractValue has type SpecHeapTop (and top for all the
> other things too). Let's say we deleted a CheckTDZ because we saw the type
> is SpecHeapTop. Let's also say that we're now OSR entering with the TDZ
> value (JSValue()). I think that would lead to a bug.

I'm not saying that it wouldn't.  I'm just saying that AbstractValue::m_value being JSValue() means "top JSValue".

So if AbstractValue::m_value is empty, it doesn't mean JSValue().

[Saam Barati]

Created attachment 365426 [details]
WIP

Currently crashing in a lot of tests. I need to figure out why.

[Saam Barati]

Created attachment 365437 [details]
patch

[EWS Watchlist]

Attachment 365437 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h:235:  The parameter name "structure" adds no information, so it should be removed.  [readability/parameter_name] [5]
ERROR: Source/JavaScriptCore/dfg/testdfg.cpp:30:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 2 in 11 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Saam Barati]

Created attachment 365439 [details]
patch

[EWS Watchlist]

Attachment 365439 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h:235:  The parameter name "structure" adds no information, so it should be removed.  [readability/parameter_name] [5]
ERROR: Source/JavaScriptCore/dfg/testdfg.cpp:30:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 2 in 11 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Yusuke Suzuki]

Comment on attachment 365439 [details]
patch

r=me too.

[WebKit Commit Bot]

Comment on attachment 365439 [details]
patch

Clearing flags on attachment: 365439

Committed r243278: <https://trac.webkit.org/changeset/243278>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/49095372>