Bug 191897 – DFGSpeculativeJIT should not &= exitOK with mayExit(node)

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

It's actually weird that we did this when you think about what each thing means. exitOK is a statement about it being legal to exit. However, mayExit tries to be as smart and use as much information as it can to make a statement about if an exit could happen at runtime when the code executes. It can't return false if a runtime exit *could* happen. However, there is code in the compiler where mayExit() returns false (because it uses data generated from AI about type checks being proved), but the code we emit may unconditionally generate code that emits an exit, even if that exit may never execute. For example, let's say we have this IR:

SomeNode(Boolean:@input)

And we always emit code like this:

jump L1 if input == true
jump L1 if input == false
emit an OSR exit

In such a program, when we generate the above OSR exit, in a validationEnabled() build, and if @input is proved to be a boolean, we'll end up crashing because we have the bogus assertion saying !exitOK. This is one reason why things are cleaner if we don't conflate mayExit() with exitOK.

[Saam Barati]

<rdar://problem/45871998>

[Saam Barati]

Created attachment 355441 [details]
patch

[Mark Lam]

Comment on attachment 355441 [details]
patch

r=me

[WebKit Commit Bot]

Comment on attachment 355441 [details]
patch

Clearing flags on attachment: 355441

Committed r238437: <https://trac.webkit.org/changeset/238437>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.