Bug 109388 - Implicit type check on local variables hoisting is unsound with respect to CFG simplification
Summary: Implicit type check on local variables hoisting is unsound with respect to CF...
Status: RESOLVED DUPLICATE of bug 109389
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on: 109371 110433
Blocks:
  Show dependency treegraph
 
Reported: 2013-02-10 14:06 PST by Filip Pizlo
Modified: 2013-02-28 12:43 PST (History)
7 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-02-10 14:06:20 PST
We may hoist int, number, cell, or boolean checks into SetLocals.  But we do so implicitly - the SetLocal doesn't "know" that it has this check; the CFA and the backend end up just deciding to put checks there without telling anyone else.  So, if you CFG simplify and get rid of a SetLocal that had a type check that you had used to construct some proof, then you're going to have a really bad time.
Comment 1 Filip Pizlo 2013-02-10 14:55:40 PST
The best way to solve this is to explicitly have the Fixup phase shove type checks into Phantom nodes with appropriate Edges that are just above the SetLocal.  Then CFG simplification will be able to "just work" and not worry about this.  This of course relies on https://bugs.webkit.org/show_bug.cgi?id=109371.
Comment 2 Filip Pizlo 2013-02-28 12:43:51 PST
My current approach to fixing this is to handle it as part of DCE hardening.

*** This bug has been marked as a duplicate of bug 109389 ***