We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClob...
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Dec 2017 03:04:22 +0000 (03:04 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Dec 2017 03:04:22 +0000 (03:04 +0000)
https://bugs.webkit.org/show_bug.cgi?id=180725
<rdar://problem/35970511>

Reviewed by Michael Saboff.

JSTests:

* stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
(f1):
(f2):
(let.o2.valueOf):

Source/JavaScriptCore:

* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGPreciseLocalClobberize.h:
(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225834 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/model-effects-properly-of-spread-over-phantom-create-rest.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGPreciseLocalClobberize.h

index d02f184b4455df9d3b4ef96a904c6018e0b767ff..2822b16161e8dc3cfb310ba933f6f24ce794cfe2 100644 (file)
@@ -1,3 +1,16 @@
+2017-12-12  Saam Barati  <sbarati@apple.com>
+
+        We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
+        https://bugs.webkit.org/show_bug.cgi?id=180725
+        <rdar://problem/35970511>
+
+        Reviewed by Michael Saboff.
+
+        * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
+        (f1):
+        (f2):
+        (let.o2.valueOf):
+
 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [JSC] Implement optimized WeakMap and WeakSet
diff --git a/JSTests/stress/model-effects-properly-of-spread-over-phantom-create-rest.js b/JSTests/stress/model-effects-properly-of-spread-over-phantom-create-rest.js
new file mode 100644 (file)
index 0000000..287906d
--- /dev/null
@@ -0,0 +1,25 @@
+"use strict";
+function f1(o) {
+    let result = [];
+    for (let key of Object.getOwnPropertyNames(o)) {
+        result.push(key)
+    }
+    return result;
+}
+function f2(a1, a2, ...args) {
+    let r = f1(a1);
+    let index = r[a2 % r.length];
+    a1[index](...args)
+}
+let theObj = {};
+let o2 = {
+    valueOf: function (a, b) {
+        a === 42
+        b === theObj
+        try {} catch (e) {}
+    }
+};
+for (let i = 0; i < 1e5; ++i) {
+    for (let j = 0; j < 100; j++) {}
+    f2(o2, 897989, 42, theObj);
+}
index a2c564545783c28ba5f1d90ca8b1548b2b834173..71ea5b830f4d45542403a3ea674771b0a1c870fe 100644 (file)
@@ -1,3 +1,16 @@
+2017-12-12  Saam Barati  <sbarati@apple.com>
+
+        We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
+        https://bugs.webkit.org/show_bug.cgi?id=180725
+        <rdar://problem/35970511>
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+
 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [JSC] Implement optimized WeakMap and WeakSet
index 93d7b7eeb3be9ede39d36f67a2a93dd9314d2ea2..a1130d00682e7e333ffc0926a3021c5db13d3daf 100644 (file)
@@ -1312,6 +1312,9 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
     }
 
     case Spread: {
+        if (node->child1()->op() == PhantomCreateRest)
+            read(Stack);
+
         if (node->child1().useKind() == ArrayUse) {
             // FIXME: We can probably CSE these together, but we need to construct the right rules
             // to prove that nobody writes to child1() in between two Spreads: https://bugs.webkit.org/show_bug.cgi?id=164531
index 16fe26f6ca6b43ce6e346e42f3ff0a40b038a9ec..a569c93bbff218d677504523b2d8af2c6117e4d5 100644 (file)
@@ -120,8 +120,8 @@ private:
                 m_read(VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount));
         };
 
-        auto readPhantomSpreadNode = [&] (Node* spread) {
-            ASSERT(spread->op() == PhantomSpread);
+        auto readSpreadOfPhantomCreateRest = [&] (Node* spread) {
+            ASSERT(spread->op() == Spread || spread->op() == PhantomSpread);
             ASSERT(spread->child1()->op() == PhantomCreateRest);
             InlineCallFrame* inlineCallFrame = spread->child1()->origin.semantic.inlineCallFrame;
             unsigned numberOfArgumentsToSkip = spread->child1()->numberOfArgumentsToSkip();
@@ -135,7 +135,7 @@ private:
                 if (bitVector->get(i)) {
                     Node* child = m_graph.varArgChild(arrayWithSpread, i).node();
                     if (child->op() == PhantomSpread)
-                        readPhantomSpreadNode(child);
+                        readSpreadOfPhantomCreateRest(child);
                 }
             }
         };
@@ -181,7 +181,7 @@ private:
                 if (m_node->argumentsChild()->op() == PhantomNewArrayWithSpread)
                     readNewArrayWithSpreadNode(m_node->argumentsChild().node());
                 else
-                    readPhantomSpreadNode(m_node->argumentsChild().node());
+                    readSpreadOfPhantomCreateRest(m_node->argumentsChild().node());
             } else {
                 InlineCallFrame* inlineCallFrame;
                 if (m_node->hasArgumentsChild() && m_node->argumentsChild())
@@ -203,6 +203,11 @@ private:
             break;
         }
         
+        case Spread:
+            if (m_node->child1()->op() == PhantomCreateRest)
+                readSpreadOfPhantomCreateRest(m_node);
+            break;
+        
         case NewArrayWithSpread: {
             readNewArrayWithSpreadNode(m_node);
             break;