Bug 149531 – We should only expect a RareCaseProfile to exist if the rare case actually exists

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

The current code that calls rareCaseProfileForBytecodeOffset() always assumes that it will always return a non-null RareCaseProfile.  As a result, op_add in the baseline JIT is forced to add a dummy slow case that will never be taken, only to ensure that the RareCaseProfile for that bytecode is created, and it will always produce a counter value of 0 (since that path will never be taken).  Instead, we'll make the callers of rareCaseProfileForBytecodeOffset() check if the profile actually exist before dereferencing it.

[Mark Lam]

Created attachment 261875 [details]
the fix.

[Saam Barati]

Comment on attachment 261875 [details]
the fix.

View in context: https://bugs.webkit.org/attachment.cgi?id=261875&action=review

r=me with comments.

> Source/JavaScriptCore/bytecode/CodeBlock.cpp:3974
> +    auto profile = rareCaseProfileForBytecodeOffset(bytecodeOffset);

nit: Can we write the actual type here?

> Source/JavaScriptCore/jit/JITArithmetic.cpp:797
>      if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {

We need 32-bit code too.

> Source/JavaScriptCore/jit/JITArithmetic.cpp:826
> +    RELEASE_ASSERT(!(!types.first().mightBeNumber() || !types.second().mightBeNumber()));

I think this reads better as: 
RELEASE_ASSERT(types.first().mightBeNumber() && types.second().mightBeNumber()))

[Mark Lam]

Thanks.  I've fixed the issues before landing.

Landed in r190213: <http://trac.webkit.org/r190213>.