Bug 160925 – Remove invalid assertion in the DFG backend's GetById emitter.

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

The DFG bytecode parser will force an OSR exit if it sees an op_get_by_id or op_get_by_val with a SpecNone prediction.  Hence, it is safe to emit code for the GetById node even if its prediction is SpecNone.  The GetById node may still be seen by the DFG backend, but it is valid for it to have a SpecNone prediction.

[Mark Lam]

<rdar://problem/27248961>

[Mark Lam]

(In reply to comment #0)
> The DFG bytecode parser will force an OSR exit if it sees an op_get_by_id or
> op_get_by_val with a SpecNone prediction.  Hence, it is safe to emit code
> for the GetById node even if its prediction is SpecNone.  The GetById node
> may still be seen by the DFG backend, but it is valid for it to have a
> SpecNone prediction.

This may not be true.  In my test locally, I'm seeing the assertion without a ForceOSRExit node preceding the GetById node.  I'll investigate further.

[Mark Lam]

My initial read of the code was wrong and misleading.  The GetById assertion that the node's prediction not be SpecNone in the DFG backend is just plain wrong.  It assumes that we can never have a GetById node without a type prediction, but that is not true.  The following test case proves otherwise:

    function foo() {
        "use strict";
        return --arguments["callee"];
    }

Will remove the assertion.  Nothing else needs to change as the DFG is working correctly without the assertion.

[Mark Lam]

Created attachment 286325 [details]
proposed patch.

[Mark Lam]

Thanks for the review.  Landed in r204570: <http://trac.webkit.org/r204570>.