Bug 191897 - DFGSpeculativeJIT should not &= exitOK with mayExit(node)
Summary: DFGSpeculativeJIT should not &= exitOK with mayExit(node)
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
Keywords: InRadar
Depends on:
Reported: 2018-11-21 15:31 PST by Saam Barati
Modified: 2018-11-21 19:43 PST (History)
12 users (show)

See Also:

patch (3.92 KB, patch)
2018-11-21 15:40 PST, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2018-11-21 15:31:07 PST
It's actually weird that we did this when you think about what each thing means. exitOK is a statement about it being legal to exit. However, mayExit tries to be as smart and use as much information as it can to make a statement about if an exit could happen at runtime when the code executes. It can't return false if a runtime exit *could* happen. However, there is code in the compiler where mayExit() returns false (because it uses data generated from AI about type checks being proved), but the code we emit may unconditionally generate code that emits an exit, even if that exit may never execute. For example, let's say we have this IR:


And we always emit code like this:

jump L1 if input == true
jump L1 if input == false
emit an OSR exit

In such a program, when we generate the above OSR exit, in a validationEnabled() build, and if @input is proved to be a boolean, we'll end up crashing because we have the bogus assertion saying !exitOK. This is one reason why things are cleaner if we don't conflate mayExit() with exitOK.
Comment 1 Saam Barati 2018-11-21 15:31:42 PST
Comment 2 Saam Barati 2018-11-21 15:40:53 PST
Created attachment 355441 [details]
Comment 3 Mark Lam 2018-11-21 16:04:41 PST
Comment on attachment 355441 [details]

Comment 4 WebKit Commit Bot 2018-11-21 19:43:38 PST
Comment on attachment 355441 [details]

Clearing flags on attachment: 355441

Committed r238437: <https://trac.webkit.org/changeset/238437>
Comment 5 WebKit Commit Bot 2018-11-21 19:43:40 PST
All reviewed patches have been landed.  Closing bug.