Changeset 259742 in webkit

Timestamp:

Apr 8, 2020, 12:06:39 PM (6 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
​https://bugs.webkit.org/show_bug.cgi?id=210175
<rdar://problem/61433817>

Reviewed by Saam Barati.

JSTests:

• stress/multi-delete-by-offset-ai-result.js: Added.

(foo):

Source/JavaScriptCore:

Since the result value of MultiDeleteByOffset should be used, AI should set boolean AbstractValue as a result of MultiDeleteByOffset.
We also add MultiDeleteByOffset to DFGStoreBarrierInsertionPhase since it can write StructureID: this means that write-barrier is necessary.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGStoreBarrierInsertionPhase.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/multi-delete-by-offset-ai-result.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
+        https://bugs.webkit.org/show_bug.cgi?id=210175
+        <rdar://problem/61433817>
+
+        Reviewed by Saam Barati.
+
+        * stress/multi-delete-by-offset-ai-result.js: Added.
+        (foo):
+
 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
+        https://bugs.webkit.org/show_bug.cgi?id=210175
+        <rdar://problem/61433817>
+
+        Reviewed by Saam Barati.
+
+        Since the result value of MultiDeleteByOffset should be used, AI should set boolean AbstractValue as a result of MultiDeleteByOffset.
+        We also add MultiDeleteByOffset to DFGStoreBarrierInsertionPhase since it can write StructureID: this means that write-barrier is necessary.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+
 2020-04-08  Angelos Oikonomopoulos  <angelos@igalia.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -3744 +3744 @@
         if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
             m_state.setIsValid(false);
+        setNonCellTypeForNode(node, SpecBoolean);
         break;
     }

trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp

@@ -298 +298 @@
             }
                 
-            case MultiPutByOffset: {
+            case MultiPutByOffset:
+            case MultiDeleteByOffset: {
                 considerBarrier(m_node->child1());
                 break;