Changeset 280704 in webkit

Timestamp:

Aug 5, 2021, 3:39:57 PM (5 years ago)

Author:

rmorisset@apple.com

Message:

REGRESSION (r280507): ASSERTION FAILED: !undominatedPhis.contains(value) in JSC::B3::(anonymous namespace)::Validater::validatePhisAreDominatedByUpsilons()
​https://bugs.webkit.org/show_bug.cgi?id=228838
<rdar://problem/81579314>

Reviewed by Geoffrey Garen.

When I added validation of the dominance of Phis by their Upsilons, I checked two things:

• There is no path from the entry point to a Phi without going through a corresponding Upsilon (the actual dominance check)
• There is no way to execute a Phi twice without going through a corresponding Upsilon in between

The second property is not actually true in B3 IR, I had misunderstood that part of the meaning of Phis/Upsilons.
So this patch just removes this second check.

It has no security/stability/performance implication: this is validation code, which runs automatically in debug mode, but should not run at all on customer machines.

• b3/B3Validate.cpp:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• b3/B3Validate.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-08-05  Robin Morisset  <rmorisset@apple.com>
+
+        REGRESSION (r280507): ASSERTION FAILED: !undominatedPhis.contains(value) in JSC::B3::(anonymous namespace)::Validater::validatePhisAreDominatedByUpsilons()
+        https://bugs.webkit.org/show_bug.cgi?id=228838
+        <rdar://problem/81579314>
+
+        Reviewed by Geoffrey Garen.
+
+        When I added validation of the dominance of Phis by their Upsilons, I checked two things:
+        - There is no path from the entry point to a Phi without going through a corresponding Upsilon (the actual dominance check)
+        - There is no way to execute a Phi twice without going through a corresponding Upsilon in between
+        The second property is not actually true in B3 IR, I had misunderstood that part of the meaning of Phis/Upsilons.
+        So this patch just removes this second check.
+
+        It has no security/stability/performance implication: this is validation code, which runs automatically in debug mode, but should not run at all on customer machines.
+
+        * b3/B3Validate.cpp:
+
 2021-08-05  Michael Catanzaro  <mcatanzaro@gnome.org>
 

trunk/Source/JavaScriptCore/b3/B3Validate.cpp

@@ -678 +678 @@
                         break;
                     case Phi:
-                        VALIDATE(!undominatedPhis.contains(value), ("At ", *value));
                         undominatedPhis.add(value);
                         break;