Changeset 185941 in webkit


Ignore:
Timestamp:
Jun 24, 2015, 9:06:08 PM (10 years ago)
Author:
fpizlo@apple.com
Message:

DFG::SpeculativeJIT shouldn't use filter==Contradiction when it meant isClear
​https://bugs.webkit.org/show_bug.cgi?id=146291
rdar://problem/21435366

Reviewed by Michael Saboff.

The filter() method returns Contradiction only when a value *becomes* clear. This is
necessary for supporting the convention that non-JSValue nodes have a bottom proved
type. (We should fix that convention eventually, but for now let's just be consistent
about it.)

  • dfg/DFGFiltrationResult.h: Document the issue.
  • dfg/DFGSpeculativeJIT32_64.cpp: Work around the issue.

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):

  • dfg/DFGSpeculativeJIT64.cpp: Work around the issue.

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):

Location:
trunk/Source/JavaScriptCore
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r185932 r185941  
     12015-06-24  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG::SpeculativeJIT shouldn't use filter==Contradiction when it meant isClear
     4        https://bugs.webkit.org/show_bug.cgi?id=146291
     5        rdar://problem/21435366
     6
     7        Reviewed by Michael Saboff.
     8       
     9        The filter() method returns Contradiction only when a value *becomes* clear. This is
     10        necessary for supporting the convention that non-JSValue nodes have a bottom proved
     11        type. (We should fix that convention eventually, but for now let's just be consistent
     12        about it.)
     13       
     14        * dfg/DFGFiltrationResult.h: Document the issue.
     15        * dfg/DFGSpeculativeJIT32_64.cpp: Work around the issue.
     16        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
     17        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
     18        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
     19        * dfg/DFGSpeculativeJIT64.cpp: Work around the issue.
     20        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
     21        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
     22        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
     23        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
     24
    1252015-06-24  Michael Saboff  <msaboff@apple.com>
    226

  • trunk/Source/JavaScriptCore/dfg/DFGFiltrationResult.h

    r164424 r185941  
    11/*
    2  * Copyright (C) 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3131namespace JSC { namespace DFG {
    3232
     33// Tells you if an operation that filters type (i.e. does a type check/speculation) will always
     34// exit. Formally, this means that the proven type of a value prior to the filter was not
     35// bottom (i.e. not "clear" or "SpecEmpty") but becomes bottom as a result of executing the
     36// filter.
     37//
     38// Note that per this definition, a filter will not return Contradiction if the node's proven
     39// type was already bottom. This is necessary because we have this yucky convention of using
     40// a proven type of bottom for nodes that don't hold JS values, like Phi nodes in ThreadedCPS
     41// and storage nodes.
    3342enum FiltrationResult {
     43    // Means that this operation may not always exit.
    3444    FiltrationOK,
     45   
     46    // Means taht this operation will always exit.
    3547    Contradiction
    3648};

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r185930 r185941  
    845845    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));
    846846
    847     if (m_interpreter.filter(value, SpecInt32) == Contradiction) {
     847    m_interpreter.filter(value, SpecInt32);
     848    if (value.isClear()) {
    848849        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    849850        returnFormat = DataFormatInt32;
    … …  
    972973    ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
    973974
    974     if (m_interpreter.filter(value, SpecCell) == Contradiction) {
     975    m_interpreter.filter(value, SpecCell);
     976    if (value.isClear()) {
    975977        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    976978        return allocate();
    … …  
    10541056    SpeculatedType type = value.m_type;
    10551057
    1056     if (m_interpreter.filter(value, SpecBoolean) == Contradiction) {
     1058    m_interpreter.filter(value, SpecBoolean);
     1059    if (value.isClear()) {
    10571060        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    10581061        return allocate();

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r185930 r185941  
    816816    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));
    817817
    818     if (m_interpreter.filter(value, SpecInt32) == Contradiction) {
     818    m_interpreter.filter(value, SpecInt32);
     819    if (value.isClear()) {
    819820        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    820821        returnFormat = DataFormatInt32;
    … …  
    957958    AbstractValue& value = m_state.forNode(edge);
    958959
    959     if (m_interpreter.filter(value, SpecMachineInt) == Contradiction) {
     960    m_interpreter.filter(value, SpecMachineInt);
     961    if (value.isClear()) {
    960962        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    961963        return allocate();
    … …  
    10921094    ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
    10931095
    1094     if (m_interpreter.filter(value, SpecCell) == Contradiction) {
     1096    m_interpreter.filter(value, SpecCell);
     1097    if (value.isClear()) {
    10951098        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    10961099        return allocate();
    … …  
    11651168    SpeculatedType type = value.m_type;
    11661169
    1167     if (m_interpreter.filter(value, SpecBoolean) == Contradiction) {
     1170    m_interpreter.filter(value, SpecBoolean);
     1171    if (value.isClear()) {
    11681172        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    11691173        return allocate();
Note: See TracChangeset for help on using the changeset viewer.