Bug 211531 - DFG ByVal nodes with ArrayModes should clobberTop until Fixup phase runs.
Summary: DFG ByVal nodes with ArrayModes should clobberTop until Fixup phase runs.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Keith Miller
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-05-06 14:30 PDT by Keith Miller
Modified: 2020-05-07 11:04 PDT (History)
7 users (show)

See Also:

Attachments
Patch (7.15 KB, patch)
2020-05-06 14:36 PDT, Keith Miller 		no flags Details | Formatted Diff | Diff
Patch (6.40 KB, patch)
2020-05-06 14:59 PDT, Keith Miller 		ysuzuki: review+
Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Keith Miller 2020-05-06 14:30:32 PDT 
GetByVal and HasIndexedProperty should clobberTop until Fixup Phase runs.
Comment 1 Keith Miller 2020-05-06 14:36:59 PDT 
Created attachment 398660 [details]
Patch
Comment 2 Keith Miller 2020-05-06 14:59:00 PDT 
Created attachment 398667 [details]
Patch
Comment 3 Keith Miller 2020-05-06 15:00:02 PDT 
rdar://problem/62838095
Comment 4 Yusuke Suzuki 2020-05-06 15:10:12 PDT 
Comment on attachment 398667 [details]
Patch

r=me
Comment 5 Mark Lam 2020-05-06 16:00:59 PDT 
Comment on attachment 398667 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=398667&action=review

> Source/JavaScriptCore/dfg/DFGClobberize.h:159
> +    // Since Fixup can do widen our ArrayModes based on profiling from other nodes we pessimistically assume

/can do widen/can widen/
Comment 6 Keith Miller 2020-05-06 17:00:39 PDT 
Committed r261260: <https://trac.webkit.org/changeset/261260>
Comment 7 Ryan Haddad 2020-05-06 20:44:03 PDT 
(In reply to Keith Miller from comment #6)
> Committed r261260: <https://trac.webkit.org/changeset/261260>
This appears to have broken 26 JSC tests:
https://build.webkit.org/builders/Apple-Catalina-Release-JSC-Tests/builds/1894
Comment 8 Ryan Haddad 2020-05-07 09:19:24 PDT 
Reverted r261260 for reason:

Caused 26 JSC test failures

Committed r261293: <https://trac.webkit.org/changeset/261293>
Comment 9 Keith Miller 2020-05-07 11:01:43 PDT 
I relanded this with https://trac.webkit.org/changeset/261313