Bug 96872 – Structure check hoisting fails to consider the possibility of conflicting checks on the source of the first assignment to the hoisted variable

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

Here's the IR:

a: Foo()
b: SetLocal(@a, r1
c: CheckStructure(@a, <blah>)
d: PutStructure(@a, <blih>)
e: CheckStructure(@a, <blih>)

Some other block:
f: GetLocal(r1)
g: CheckStructure(@a, <blih>)

If we hoist the structure check for structure <blih>, we'll end up always OSR exiting since at the point of @b, the structure is still <blah>.  The reason for this omission in the due diligence of structure check hoister is that while it looks at all CheckStructures on GetLocals on r1, it fails to look at CheckStructures on @a.

[Filip Pizlo]

Created attachment 164298 [details]
the patch

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/128699

[Csaba Osztrogonác]

(In reply to comment #2)
> Landed in http://trac.webkit.org/changeset/128699

It made 2 tests assert on Qt - https://bugs.webkit.org/show_bug.cgi?id=96907
Could you check it, please?

[Filip Pizlo]

(In reply to comment #3)
> (In reply to comment #2)
> > Landed in http://trac.webkit.org/changeset/128699
> 
> It made 2 tests assert on Qt - https://bugs.webkit.org/show_bug.cgi?id=96907
> Could you check it, please?

I'm on it.  It's confusing though - I don't see the assertions on Mac.