Bug 88261 - DFG arguments simplification takes unkindly to direct accesses to the arguments register
Summary: DFG arguments simplification takes unkindly to direct accesses to the argumen...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-06-04 15:29 PDT by Filip Pizlo
Modified: 2012-06-04 16:28 PDT (History)
1 user (show)

See Also:

Attachments
the patch (41.17 KB, patch)
2012-06-04 15:33 PDT, Filip Pizlo 		ggaren: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-06-04 15:29:47 PDT 
And by "takes unkindly" I mean that it either crashes during JITing or generates hopelessly wrong code.

It turns out that we had basically no coverage over what happens if a function uses arguments and is otherwise so trivial that CSE doesn't run.
Comment 1 Filip Pizlo 2012-06-04 15:33:37 PDT 
Created attachment 145642 [details]
the patch
Comment 2 WebKit Review Bot 2012-06-04 15:37:47 PDT 
Attachment 145642 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1
Source/JavaScriptCore/dfg/DFGCSEPhase.cpp:911:  One line control clauses should not use braces.  [whitespace/braces] [4]
Total errors found: 1 in 18 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 3 Geoffrey Garen 2012-06-04 16:00:39 PDT 
Comment on attachment 145642 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=145642&action=review

r=me

> Source/JavaScriptCore/dfg/DFGCSEPhase.cpp:686
> +                // If the optimization fixpoint has not converged then this may read locals.
> +                if (m_fixpointState == FixpointNotConverged)
>                      result.mayBeAccessed = true;

Only necessary if we've predicted arguments here.
Comment 4 Filip Pizlo 2012-06-04 16:28:34 PDT 
Landed in http://trac.webkit.org/changeset/119437