Changeset 204570 in webkit

Timestamp:

Aug 17, 2016, 2:00:45 PM (9 years ago)

Author:

mark.lam@apple.com

Message:

Remove an invalid assertion in the DFG backend's GetById emitter.
​https://bugs.webkit.org/show_bug.cgi?id=160925
<rdar://problem/27248961>

Reviewed by Filip Pizlo.

JSTests:

• stress/dfg-get-by-id-should-not-assert-non-null-prediction.js: Added.

Source/JavaScriptCore:

The DFG backend's GetById assertion that the node's prediction not be SpecNone
is just plain wrong. It assumes that we can never have a GetById node without a
type prediction, but this is not true. The following test case proves otherwise:

function foo() {

"use strict";
return --argumentscallee;

}

Will remove the assertion. Nothing else needs to change as the DFG is working
correctly without the assertion.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/dfg-get-by-id-should-not-assert-non-null-prediction.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2016-08-17  Mark Lam  <mark.lam@apple.com>
+
+        Remove an invalid assertion in the DFG backend's GetById emitter.
+        https://bugs.webkit.org/show_bug.cgi?id=160925
+        <rdar://problem/27248961>
+
+        Reviewed by Filip Pizlo.
+
+        * stress/dfg-get-by-id-should-not-assert-non-null-prediction.js: Added.
+
 2016-08-16  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-08-17  Mark Lam  <mark.lam@apple.com>
+
+        Remove an invalid assertion in the DFG backend's GetById emitter.
+        https://bugs.webkit.org/show_bug.cgi?id=160925
+        <rdar://problem/27248961>
+
+        Reviewed by Filip Pizlo.
+
+        The DFG backend's GetById assertion that the node's prediction not be SpecNone
+        is just plain wrong.  It assumes that we can never have a GetById node without a
+        type prediction, but this is not true.  The following test case proves otherwise:
+
+            function foo() {
+                "use strict";
+                return --arguments["callee"];
+            }
+
+        Will remove the assertion.  Nothing else needs to change as the DFG is working
+        correctly without the assertion.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2016-08-16  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -4176 +4176 @@
 
     case GetById: {
-        ASSERT(node->prediction());
-        
         switch (node->child1().useKind()) {
         case CellUse: {

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -4121 +4121 @@
 
     case GetById: {
-        ASSERT(node->prediction());
-
         switch (node->child1().useKind()) {
         case CellUse: {