Changeset 238437 in webkit
- Timestamp:
- Nov 21, 2018 7:43:30 PM (5 years ago)
- Location:
- trunk
- Files:
-
- 1 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r238436 r238437 1 2018-11-21 Saam barati <sbarati@apple.com> 2 3 DFGSpeculativeJIT should not &= exitOK with mayExit(node) 4 https://bugs.webkit.org/show_bug.cgi?id=191897 5 <rdar://problem/45871998> 6 7 Reviewed by Mark Lam. 8 9 * stress/exitok-is-not-the-same-as-mayExit.js: Added. 10 (bar): 11 (foo): 12 1 13 2018-11-21 Saam barati <sbarati@apple.com> 2 14 -
trunk/Source/JavaScriptCore/ChangeLog
r238436 r238437 1 2018-11-21 Saam barati <sbarati@apple.com> 2 3 DFGSpeculativeJIT should not &= exitOK with mayExit(node) 4 https://bugs.webkit.org/show_bug.cgi?id=191897 5 <rdar://problem/45871998> 6 7 Reviewed by Mark Lam. 8 9 exitOK is a statement about it being legal to exit. mayExit() is about being 10 conservative and returning false only if an OSR exit *could never* happen. 11 mayExit() tries to be as smart as possible to see if it can return false. 12 It can't return false if a runtime exit *could* happen. However, there is 13 code in the compiler where mayExit() returns false (because it uses data 14 generated from AI about type checks being proved), but the code we emit in the 15 compiler backend unconditionally generates an OSR exit, even if that exit may 16 never execute. For example, let's say we have this IR: 17 18 SomeNode(Boolean:@input) 19 20 And we always emit code like this as a way of emitting a boolean type check: 21 22 jump L1 if input == true 23 jump L1 if input == false 24 emit an OSR exit 25 26 In such a program, when we generate the above OSR exit, in a validationEnabled() 27 build, and if @input is proved to be a boolean, we'll end up crashing because we 28 have the bogus assertion saying !exitOK. This is one reason why things are cleaner 29 if we don't conflate mayExit() with exitOK. 30 31 * dfg/DFGSpeculativeJIT.cpp: 32 (JSC::DFG::SpeculativeJIT::compileCurrentBlock): 33 1 34 2018-11-21 Saam barati <sbarati@apple.com> 2 35 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
r238436 r238437 1841 1841 m_jit.setForNode(m_currentNode); 1842 1842 m_origin = m_currentNode->origin; 1843 if (validationEnabled())1844 m_origin.exitOK &= mayExit(m_jit.graph(), m_currentNode) == Exits;1845 1843 m_lastGeneratedNode = m_currentNode->op(); 1846 1844
Note: See TracChangeset
for help on using the changeset viewer.