Bug 88261 – DFG arguments simplification takes unkindly to direct accesses to the arguments register

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

And by "takes unkindly" I mean that it either crashes during JITing or generates hopelessly wrong code.

It turns out that we had basically no coverage over what happens if a function uses arguments and is otherwise so trivial that CSE doesn't run.

[Filip Pizlo]

Created attachment 145642 [details]
the patch

[WebKit Review Bot]

Attachment 145642 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1
Source/JavaScriptCore/dfg/DFGCSEPhase.cpp:911:  One line control clauses should not use braces.  [whitespace/braces] [4]
Total errors found: 1 in 18 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Geoffrey Garen]

Comment on attachment 145642 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=145642&action=review

r=me

> Source/JavaScriptCore/dfg/DFGCSEPhase.cpp:686
> +                // If the optimization fixpoint has not converged then this may read locals.
> +                if (m_fixpointState == FixpointNotConverged)
>                      result.mayBeAccessed = true;

Only necessary if we've predicted arguments here.

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/119437