[DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 30 Nov 2017 20:48:53 +0000 (20:48 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 30 Nov 2017 20:48:53 +0000 (20:48 +0000)
commit16e9c1e05375a8d25cf0e1eb98cf505b5eb30aa6
treed998a5d5eb45de623c4e77e3b2366a238626e999
parentaa66e2205d7f6bf61bcf6bfd72589b17119fe4b9
[DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
https://bugs.webkit.org/show_bug.cgi?id=180190

Reviewed by Mark Lam.

JSTests:

* stress/operation-in-may-have-negative-int32-array-storage.js: Added.
(shouldBe):
(test1):
* stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
(shouldBe):
(test1):
* stress/operation-in-may-have-negative-int32-double-array.js: Added.
(shouldBe):
(test1):
* stress/operation-in-may-have-negative-int32-generic-array.js: Added.
(shouldBe):
(test1):
* stress/operation-in-may-have-negative-int32-int32-array.js: Added.
(shouldBe):
(test1):
* stress/operation-in-may-have-negative-int32.js: Added.
(shouldBe):
(test2):
* stress/operation-in-negative-int32-cast.js: Added.
(shouldBe):
(test1):

Source/JavaScriptCore:

If DFG HasIndexedProperty node observes negative index, it goes to a slow
path by calling operationHasIndexedProperty. The problem is that
operationHasIndexedProperty does not account negative index. Negative index
was used as uint32 array index.

In this patch we add a path for negative index in operationHasIndexedProperty.
And rename it to operationHasIndexedPropertyByInt to make intension clear.
We also move operationHasIndexedPropertyByInt from JITOperations to DFGOperations
since it is only used in DFG and FTL.

While fixing this bug, we found that our op_in does not record OutOfBound feedback.
This causes repeated OSR exit and significantly regresses the performance. We opened
a bug to track this issue[1].

[1]: https://bugs.webkit.org/show_bug.cgi?id=180192

* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
* jit/JITOperations.cpp:
* jit/JITOperations.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225342 268f45cc-cd09-0410-ab3c-d52691b4dbfc
16 files changed:
JSTests/ChangeLog
JSTests/stress/operation-in-may-have-negative-int32-array-storage.js [new file with mode: 0644]
JSTests/stress/operation-in-may-have-negative-int32-contiguous-array.js [new file with mode: 0644]
JSTests/stress/operation-in-may-have-negative-int32-double-array.js [new file with mode: 0644]
JSTests/stress/operation-in-may-have-negative-int32-generic-array.js [new file with mode: 0644]
JSTests/stress/operation-in-may-have-negative-int32-int32-array.js [new file with mode: 0644]
JSTests/stress/operation-in-may-have-negative-int32.js [new file with mode: 0644]
JSTests/stress/operation-in-negative-int32-cast.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGOperations.cpp
Source/JavaScriptCore/dfg/DFGOperations.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Source/JavaScriptCore/jit/JITOperations.cpp
Source/JavaScriptCore/jit/JITOperations.h