DFG CFA filters CheckFunction in a really weird way, and assumes that the function...

DFG CFA filters CheckFunction in a really weird way, and assumes that the function's structure won't change
https://bugs.webkit.org/show_bug.cgi?id=115077

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

The filtering did three things that are unusual:

1) AbstractValue::filterByValue() assumed that the passed value's structure wouldn't change, in
   the sense that at it assumed it could use that value's *current* structure to do structure
   filtering. Filtering by structure only makes sense if you can prove that the given value will
   always have that structure (for example by either using a watchpoing or emitting code that
   checks that structure at run-time).

2) AbstractValue::filterByValue() and the CheckFunction case in AbstractState::executeEffects()
   tried to invalidate the CFA based on whether the filtration led to an empty value. This is
   well-intentioned, but it's not how the CFA currently works. It's inconsistent with other
   parts of the CFA. We shouldn't introduce this feature into just one kind of filtration and
   not have it elsewhere.

3) The attempt to detect when the value was empty was actually implemented incorrectly. It
   relied on AbstractValue::validate(). That method says that a concrete value does not belong
   to the abstract value if it has a different structure. This makes sense for the other place
   where AbstractValue::validate() is called: during OSR entry, where we are talking about a
   JSValue that we see *right now*. It doesn't make sense in the CFA, since in the CFA any
   value we observe in the code is a value whose structure may change when the code starts
   running, and so we cannot use the value's current structure to infer things about the code
   when it starts running.

I fixed the above problems by (1) changing filterByValue() to not filter the structure, (2)
changing filterByValue() and the CheckFunction case to not invalidate the CFA, and (3)
making sure that nobody else was misusing AbstractValue::validate() (they weren't).

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::executeEffects):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::filterByValue):

LayoutTests:

Reviewed by Oliver Hunt.

This hilarious test fails prior to the rest of this patch.

* fast/js/dfg-check-function-change-structure-expected.txt: Added.
* fast/js/dfg-check-function-change-structure.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-check-function-change-structure.js: Added.
(foo):
(bar):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@149016 268f45cc-cd09-0410-ab3c-d52691b4dbfc