PutStructure AI rule needs to call didFoldClobberStructures when the incoming value...

https://bugs.webkit.org/show_bug.cgi?id=186169

Reviewed by Mark Lam.

If we don't do this, the CFA validation rule about StructureID being
clobbered but AI not clobbering or folding a clobber will cause us
to crash. Simon was running into this yesterday on arstechnica.com.
I couldn't come up with a test case for this, but it's obvious
what the issue is by looking at the IR dump at the time of the crash.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232384 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index c034df3..bbc4abf 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,5 +1,21 @@
 2018-05-31  Saam Barati  <sbarati@apple.com>
 
+        PutStructure AI rule needs to call didFoldClobberStructures when the incoming value's structure set is clear
+        https://bugs.webkit.org/show_bug.cgi?id=186169
+
+        Reviewed by Mark Lam.
+
+        If we don't do this, the CFA validation rule about StructureID being
+        clobbered but AI not clobbering or folding a clobber will cause us
+        to crash. Simon was running into this yesterday on arstechnica.com.
+        I couldn't come up with a test case for this, but it's obvious
+        what the issue is by looking at the IR dump at the time of the crash.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2018-05-31  Saam Barati  <sbarati@apple.com>
+
         JSImmutableButterfly should align its variable storage
         https://bugs.webkit.org/show_bug.cgi?id=186159
 

diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
index a517595..d490d42 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -2763,6 +2763,9 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
                     clobberLimit, node->transition()->previous, node->transition()->next);
                 forNode(node->child1()).changeStructure(m_graph, node->transition()->next);
             }
+        } else {
+            // We're going to exit before we get here, but for the sake of validation, we've folded our write to StructureID.
+            didFoldClobberStructures();
         }
         break;
     case GetButterfly: