[webkit-changes] [WebKit/WebKit] 5e1033: Fix variable liveness for try catch in DFG

[EWS]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 5e1033a7cd0361a94d7af3ca78c81873f33aa6a8
      https://github.com/WebKit/WebKit/commit/5e1033a7cd0361a94d7af3ca78c81873f33aa6a8
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2023-02-03 (Fri, 03 Feb 2023)

  Changed paths:
    A JSTests/stress/try-catch-backwards-propagation.js
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGGraph.cpp
    M Source/JavaScriptCore/dfg/DFGGraph.h
    M Source/JavaScriptCore/dfg/DFGLiveCatchVariablePreservationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGPlan.cpp

  Log Message:
  -----------
  Fix variable liveness for try catch in DFG
https://bugs.webkit.org/show_bug.cgi?id=239758
rdar://92654142

Reviewed by Yusuke Suzuki.

There is no successor and predecessor relationship between try and catch
block in DFG, in other words node flags cannot be passed from catch block
to its `predecessors`. If a variable defined outside the try catch block
but only be used in the catch block, then our compiler would mis-analyze
the liveness of the varible w.r.t the catch block. Therefore,
`LiveCatchVariablePreservationPhase` should be to performed before backwards propagation.

* JSTests/stress/try-catch-backwards-propagation.js: Added.
(throwFunction):
(foo1):
(foo2):
(foo3):
(foo4):
(foo5):
(foo6):
(foo7):
(foo8):
(foo9):
(foo10):
(foo11):
(foo12):
(opt):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parse):
* Source/JavaScriptCore/dfg/DFGLiveCatchVariablePreservationPhase.cpp:
(JSC::DFG::LiveCatchVariablePreservationPhase::LiveCatchVariablePreservationPhase):
(JSC::DFG::LiveCatchVariablePreservationPhase::handleBlockForTryCatch):
(JSC::DFG::performLiveCatchVariablePreservationPhase):
* Source/JavaScriptCore/dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):

Canonical link: https://commits.webkit.org/259839@main