The DFG Integer Check Combining phase should force an OSR exit for CheckInBounds...

https://bugs.webkit.org/show_bug.cgi?id=169933
<rdar://problem/31105125>

Reviewed by Filip Pizlo and Geoffrey Garen.

Also fixed the bit-rotted RangeKey::dump() function.

* dfg/DFGIntegerCheckCombiningPhase.cpp:
(JSC::DFG::IntegerCheckCombiningPhase::handleBlock):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@214240 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 83b62b1..75bfb58 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2017-03-21  Mark Lam  <mark.lam@apple.com>
+
+        The DFG Integer Check Combining phase should force an OSR exit for CheckInBounds on a negative constant min bound.
+        https://bugs.webkit.org/show_bug.cgi?id=169933
+        <rdar://problem/31105125>
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        Also fixed the bit-rotted RangeKey::dump() function.
+
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+
 2017-03-21  Csaba Osztrogonác  <ossy@webkit.org>
 
         [ARM] Add missing MacroAssembler functions after r214187

diff --git a/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp b/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp
index 01e1e3c..fc417d7 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -105,7 +105,16 @@ struct RangeKey {
             out.print("ArrayBounds(");
             break;
         }
-        out.print(m_source, ", ", m_key, ")");
+        if (m_source)
+            out.print(m_source);
+        else
+            out.print("null");
+        out.print(", ");
+        if (m_key)
+            out.print(m_key);
+        else
+            out.print("null");
+        out.print(")");
     }
     
     RangeKind m_kind;
@@ -249,7 +258,13 @@ private:
                     Node* maxNode;
                     
                     if (!data.m_key.m_source) {
-                        minNode = 0;
+                        // data.m_key.m_source being null means that we're comparing against int32 constants (see rangeKeyAndAddend()).
+                        // Since CheckInBounds does an unsigned comparison, if the minBound >= 0, it is also covered by the
+                        // maxBound comparison. However, if minBound < 0, then CheckInBounds should always fail its speculation check.
+                        // We'll force an OSR exit in that case.
+                        minNode = nullptr;
+                        if (range.m_minBound < 0)
+                            m_insertionSet.insertNode(nodeIndex, SpecNone, ForceOSRExit, node->origin);
                         maxNode = m_insertionSet.insertConstant(
                             nodeIndex, maxOrigin, jsNumber(range.m_maxBound));
                     } else {