Bug 216669 - DFG should ensure there are PhantomLocals for the taken block of op_jneq_ptr
Summary: DFG should ensure there are PhantomLocals for the taken block of op_jneq_ptr
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Keith Miller
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-09-17 16:09 PDT by Keith Miller
Modified: 2020-09-18 12:35 PDT (History)
6 users (show)

See Also:


Attachments
Patch (3.58 KB, patch)
2020-09-17 16:14 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Patch (3.58 KB, patch)
2020-09-17 16:15 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Patch for landing (4.14 KB, patch)
2020-09-18 11:36 PDT, Keith Miller
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Keith Miller 2020-09-17 16:09:22 PDT
DFG should ensure there are PhantomLocals for the not-taken block of op_jneq_ptr
Comment 1 Keith Miller 2020-09-17 16:14:09 PDT
Created attachment 409077 [details]
Patch
Comment 2 Keith Miller 2020-09-17 16:15:23 PDT
Created attachment 409079 [details]
Patch
Comment 3 Keith Miller 2020-09-17 16:15:41 PDT
rdar://68968982
Comment 4 Saam Barati 2020-09-18 10:46:50 PDT
Comment on attachment 409079 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=409079&action=review

> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:7175
> +            flushForTerminalImpl(CodeOrigin(BytecodeIndex(m_currentIndex.offset() + relativeOffset), inlineCallFrame()), addFlushDirect, addPhantomLocalDirect);

why not the current code origin?
Comment 5 Keith Miller 2020-09-18 10:57:38 PDT
Comment on attachment 409079 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=409079&action=review

>> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:7175
>> +            flushForTerminalImpl(CodeOrigin(BytecodeIndex(m_currentIndex.offset() + relativeOffset), inlineCallFrame()), addFlushDirect, addPhantomLocalDirect);
> 
> why not the current code origin?

Because the set of live locals at the target is a subset of the locals live here. There's no point in Phantoming things that we don't need to.
Comment 6 Saam Barati 2020-09-18 11:01:43 PDT
Comment on attachment 409079 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=409079&action=review

>>> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:7175
>>> +            auto addPhantomLocalDirect = [&] (InlineCallFrame*, Operand operand) { phantomLocalDirect(operand); };
>>> +            flushForTerminalImpl(CodeOrigin(BytecodeIndex(m_currentIndex.offset() + relativeOffset), inlineCallFrame()), addFlushDirect, addPhantomLocalDirect);
>> 
>> why not the current code origin?
> 
> Because the set of live locals at the target is a subset of the locals live here. There's no point in Phantoming things that we don't need to.

let's add the comment on why we flushForTerminal here, since we don't know if the target would've ended up doing it
Comment 7 Keith Miller 2020-09-18 11:36:28 PDT
Created attachment 409153 [details]
Patch for landing
Comment 8 EWS 2020-09-18 12:34:26 PDT
Committed r267255: <https://trac.webkit.org/changeset/267255>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 409153 [details].
Comment 9 Radar WebKit Bug Importer 2020-09-18 12:35:16 PDT
<rdar://problem/69168812>