Bug 196116 – Remove an invalid assertion in DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined().

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

The DFG backend should not make assumptions about what optimizations the front end will or will not do.  The assertion asserts that the operand cannot be known to be a cell.  However, it is not guaranteed that the front end will fold away this case.  Also, the DFG backend is perfectly capable of generating code to handle the case where the operand is a cell.

<rdar://problem/48976951>

[Mark Lam]

Created attachment 365639 [details]
proposed patch.

[Filip Pizlo]

Comment on attachment 365639 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=365639&action=review

> Source/JavaScriptCore/ChangeLog:10
> +        The DFG backend should not make assumptions about what optimizations the front end
> +        will or will not do.  The assertion asserts that the operand cannot be known to be

You're right - the DFG is making a back assumption here because optimizations should be optional.

[Filip Pizlo]

(In reply to Filip Pizlo from comment #2)
> Comment on attachment 365639 [details]
> proposed patch.
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=365639&action=review
> 
> > Source/JavaScriptCore/ChangeLog:10
> > +        The DFG backend should not make assumptions about what optimizations the front end
> > +        will or will not do.  The assertion asserts that the operand cannot be known to be
> 
> You're right - the DFG is making a back assumption here because
> optimizations should be optional.

*bad assumption

[Mark Lam]

Thanks for the review.  Landed in r243344: <http://trac.webkit.org/r243344>.

[Saam Barati]

Comment on attachment 365639 [details]
proposed patch.

LGTM too.