Changeset 97240 in webkit

Timestamp:

Oct 12, 2011 1:01:11 AM (13 years ago)

Author:

fpizlo@apple.com

Message:

Layout tests crashing in DFG JIT code
​https://bugs.webkit.org/show_bug.cgi?id=69897

Reviewed by Gavin Barraclough.

Abstract value filtration didn't take into account cases where a structure
set filter, combined with predicted type knowledge, could lead to a stronger
filter for the structure abstract value.

This bug would have been benign in release builds; it would have just meant
that the analysis was less precise and some optimization opportunities would
be missed. I have an ASSERT that is meant to catch such cases, and it was
triggering sporadically in one of the LayoutTests.

• dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::filter):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGAbstractValue.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Layout tests crashing in DFG JIT code
+        https://bugs.webkit.org/show_bug.cgi?id=69897
+
+        Reviewed by Gavin Barraclough.
+        
+        Abstract value filtration didn't take into account cases where a structure
+        set filter, combined with predicted type knowledge, could lead to a stronger
+        filter for the structure abstract value.
+        
+        This bug would have been benign in release builds; it would have just meant
+        that the analysis was less precise and some optimization opportunities would
+        be missed. I have an ASSERT that is meant to catch such cases, and it was
+        triggering sporadically in one of the LayoutTests.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::filter):
+
 2011-10-11  Gavin Barraclough  <baraclough@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h

@@ -403 +403 @@
         m_type &= other.predictionFromStructures();
         m_structure.filter(other);
+        
+        // It's possible that prior to the above two statements we had (Foo, TOP), where
+        // Foo is a PredictedType that is disjoint with the passed StructureSet. In that
+        // case, we will now have (None, [someStructure]). In general, we need to make
+        // sure that new information gleaned from the PredictedType needs to be fed back
+        // into the information gleaned from the StructureSet.
+        m_structure.filter(m_type);
     }