[webkit-changes] [WebKit/WebKit] 7a9106: [32 bit] DFG graph generation: intrinsic getters a...

[jjgriego]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 7a9106c7a56f0cd97901a535361ba5418900e058
      https://github.com/WebKit/WebKit/commit/7a9106c7a56f0cd97901a535361ba5418900e058
  Author: Joseph Griego <jgriego at igalia.com>
  Date:   2023-08-31 (Thu, 31 Aug 2023)

  Changed paths:
    A JSTests/stress/typed-array-intrinsic-getter-with-conflicting-value-profile.js
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

  Log Message:
  -----------
  [32 bit] DFG graph generation: intrinsic getters are fallible
https://bugs.webkit.org/show_bug.cgi?id=260908

Reviewed by Yusuke Suzuki.

On 32-bit, unlike 64-bit, some of the DFG intrinsic getters (really, the
TypedArray ones) are _fallible_: if the SpeculatedType doesn't match our
expecations (a non-strict subset of SpecInt32Only), we refuse to generate code. [1]

However, DFG::ByteCodeParser::handleGetById doesn't appear to handle this case
gracefully--if `handleIntrinsicGetter` fails, we attempt to generate a call to
the getter, but in the case of TypedArray intrinsics, we won't have the
necessary CallLinkStatus and while attempting to do so, we crash.

To fix this, I've added a bit of code that handles the failure from
handleIntrinsicGetter and emits an ordinary `GetById` node instead of trying to
inline anything for this op.

I've added a test that demonstrates the current behavior (a segfault) on armv7
and passes with tihs patch.

[1] For what it's worth, maybe this shouldn't be the case: it does seem like we
should still be able to generate code in these cases anyhow, but it's simpler to
just cope with the failure.

* JSTests/stress/typed-array-intrinsic-getter-with-conflicting-value-profile.js: Added.
(foo):
(i.null.foo.Object.create):
(i.42.foo):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleGetById):

Canonical link: https://commits.webkit.org/267511@main