Bug 72542 - DFG global variable CSE mishandles the cross-global-object inlining corner case
Summary: DFG global variable CSE mishandles the cross-global-object inlining corner case
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2011-11-16 13:47 PST by Filip Pizlo
Modified: 2011-11-16 15:22 PST (History)
0 users

See Also:


Attachments
the patch (4.24 KB, patch)
2011-11-16 13:57 PST, Filip Pizlo
no flags Details | Formatted Diff | Diff
the patch (8.22 KB, patch)
2011-11-16 15:13 PST, Filip Pizlo
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-11-16 13:47:57 PST
The DFG GetGlobalVar is smart enough to know which global object to read from when it is used from inlined code, if the inlinee comes from a different global object than the inline caller.  But CSE is not smart enough to handle this, and may replace a GetGlobalVar from one global object with a GetGlobalVar from another global object, if the inline caller and inlinee (or two different inlinees) both did GetGlobalVar on the same identifier.
Comment 1 Filip Pizlo 2011-11-16 13:57:08 PST
Created attachment 115445 [details]
the patch

Going to investigate making a test for this in LayoutTests.
Comment 2 Filip Pizlo 2011-11-16 15:13:34 PST
Created attachment 115457 [details]
the patch

Added a test case, and checked that it indeed does break on ToT but not with my changes.
Comment 3 Geoffrey Garen 2011-11-16 15:16:25 PST
Comment on attachment 115457 [details]
the patch

r=me

Please copy this to Radar.
Comment 4 Filip Pizlo 2011-11-16 15:17:30 PST
<rdar://problem/10458466>
Comment 5 Filip Pizlo 2011-11-16 15:22:45 PST
Landed in http://trac.webkit.org/changeset/100514