Bug 84746 – DFG performs incorrect DCE on (some?) intrinsics

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

Take this beautiful piece of code:
function f(a,b,c) {
    if (a) Math.abs(b); // or Math.max(b,c)
}
var o = {valueOf:function(){return print("Working");}}
var i = 0

var forceDFGCompile = true;

for (; forceDFGCompile&&i < 10000; i++)
    if (i & 1) f(true, 5.5, 5.6);
    else f(false, o, i);
f(true, o,i);


This should output "Working", but does not if the DFG is enabled.  This seems to happen to some extent with all the intrinsics.  If you set forceDFGCompile to false, it works as expected.

[Oliver Hunt]

<rdar://problem/11310772>

[Oliver Hunt]

Returning the result of the intrinsic produces the correct result, so i think this is a DCE bug.

[Filip Pizlo]

Created attachment 138621 [details]
the patch

[Filip Pizlo]

Working on hacking up some layout tests. Can I get an RS for those too?

[Oliver Hunt]

Comment on attachment 138621 [details]
the patch

r=me, rs=me for tests.

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/115103

[Csaba Osztrogonác]

Reopen, because it broke the Qt build:
/home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: In member function ‘void JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&)’:
/home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2058: error: ‘isPredictedNumber’ was not declared in this scope

[Filip Pizlo]

(In reply to comment #7)
> Reopen, because it broke the Qt build:
> /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: In member function ‘void JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&)’:
> /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2058: error: ‘isPredictedNumber’ was not declared in this scope

Oh noes!  Looking at this now.

[Filip Pizlo]

(In reply to comment #8)
> (In reply to comment #7)
> > Reopen, because it broke the Qt build:
> > /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: In member function ‘void JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&)’:
> > /home/webkitbuildbot/slaves/release32bit-qt5/buildslave/qt-linux-32-release-qt5/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2058: error: ‘isPredictedNumber’ was not declared in this scope
> 
> Oh noes!  Looking at this now.

Oh, it's a stupid typo.  Fix on the way.

[Filip Pizlo]

Build fix for 32-bit landed in http://trac.webkit.org/changeset/115105