Bug 206571

Summary: [JSC] Add CheckArrayOrEmpty to handle the case when hoisting CheckArray for places where input can be empty
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: New BugsAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch saam: review+

Yusuke Suzuki
Reported 2020-01-21 23:12:21 PST
[JSC] Add CheckArrayOrEmpty to handle the case when hoisting CheckArray for places where input can be empty
Attachments
Patch (31.70 KB, patch)
2020-01-21 23:18 PST, Yusuke Suzuki 		saam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2020-01-21 23:18:38 PST
Created attachment 388398 [details] Patch
Yusuke Suzuki
Comment 2 2020-01-21 23:19:10 PST
<rdar://problem/58757016>
Saam Barati
Comment 3 2020-01-22 08:33:03 PST
Comment on attachment 388398 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=388398&action=review > Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:287 > + // check just remains, and it works as CheckArrayOrEmpty without ArrayMode checking. Seems like we should also have an assert here like speculatedTypeForUseKind(node->child1().useKind()) & SpecEmpty > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:832 > + // We can purge Empty check completely in this case of CheckArrayOrEmpty since CellUse only accepts SpecCell | SpecEmpty. Ditto
Yusuke Suzuki
Comment 4 2020-01-22 12:33:06 PST
Comment on attachment 388398 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=388398&action=review >> Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:287 >> + // check just remains, and it works as CheckArrayOrEmpty without ArrayMode checking. > > Seems like we should also have an assert here like > speculatedTypeForUseKind(node->child1().useKind()) & SpecEmpty Fixed. >> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:832 >> + // We can purge Empty check completely in this case of CheckArrayOrEmpty since CellUse only accepts SpecCell | SpecEmpty. > > Ditto Fixed.
Yusuke Suzuki
Comment 5 2020-01-22 12:45:43 PST
Committed r254936: <https://trac.webkit.org/changeset/254936>
Note You need to log in before you can comment on or make changes to this bug.