<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[183310] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/183310">183310</a></dd>
<dt>Author</dt> <dd>mark.lam@apple.com</dd>
<dt>Date</dt> <dd>2015-04-25 08:43:45 -0700 (Sat, 25 Apr 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>mayExit() is wrong about Branch nodes with ObjectOrOtherUse: they can exit.
https://bugs.webkit.org/show_bug.cgi?id=144152
Reviewed by Filip Pizlo.
Changed the EdgeMayExit functor to recognize ObjectUse, ObjectOrOtherUse,
StringObjectUse, and StringOrStringObjectUse kinds as potentially triggering
OSR exits. This was overlooked in the original code.
While only the ObjectOrOtherUse kind is relevant for manifesting this bug with
the Branch node, the other 3 may also trigger the same bug for other nodes.
To prevent this bug from manifesting with other nodes (and future ones that
are yet to be added to mayExits()'s "potential won't exit" set), we fix the
EdgeMayExit functor to handle all 4 use kinds (instead of just ObjectOrOtherUse).
Also added a test to exercise a code path that will trigger this bug with
the Branch node before the fix is applied.
* dfg/DFGMayExit.cpp:
* tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js: Added.
(inlinedFunction):
(foo):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGMayExitcpp">trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstressbranchmayexitduetoobjectorotherusekindjs">trunk/Source/JavaScriptCore/tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (183309 => 183310)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2015-04-25 08:13:03 UTC (rev 183309)
+++ trunk/Source/JavaScriptCore/ChangeLog 2015-04-25 15:43:45 UTC (rev 183310)
</span><span class="lines">@@ -1,3 +1,28 @@
</span><ins>+2015-04-25 Mark Lam <mark.lam@apple.com>
+
+ mayExit() is wrong about Branch nodes with ObjectOrOtherUse: they can exit.
+ https://bugs.webkit.org/show_bug.cgi?id=144152
+
+ Reviewed by Filip Pizlo.
+
+ Changed the EdgeMayExit functor to recognize ObjectUse, ObjectOrOtherUse,
+ StringObjectUse, and StringOrStringObjectUse kinds as potentially triggering
+ OSR exits. This was overlooked in the original code.
+
+ While only the ObjectOrOtherUse kind is relevant for manifesting this bug with
+ the Branch node, the other 3 may also trigger the same bug for other nodes.
+ To prevent this bug from manifesting with other nodes (and future ones that
+ are yet to be added to mayExits()'s "potential won't exit" set), we fix the
+ EdgeMayExit functor to handle all 4 use kinds (instead of just ObjectOrOtherUse).
+
+ Also added a test to exercise a code path that will trigger this bug with
+ the Branch node before the fix is applied.
+
+ * dfg/DFGMayExit.cpp:
+ * tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js: Added.
+ (inlinedFunction):
+ (foo):
+
</ins><span class="cx"> 2015-04-24 Commit Queue <commit-queue@webkit.org>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r183288.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGMayExitcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp (183309 => 183310)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp 2015-04-25 08:13:03 UTC (rev 183309)
+++ trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp 2015-04-25 15:43:45 UTC (rev 183310)
</span><span class="lines">@@ -45,7 +45,21 @@
</span><span class="cx">
</span><span class="cx"> void operator()(Node*, Edge edge)
</span><span class="cx"> {
</span><del>- m_result |= edge.willHaveCheck();
</del><ins>+ if (edge.willHaveCheck()) {
+ m_result = true;
+ return;
+ }
+
+ switch (edge.useKind()) {
+ case ObjectUse:
+ case ObjectOrOtherUse:
+ case StringObjectUse:
+ case StringOrStringObjectUse:
+ m_result = true;
+ break;
+ default:
+ break;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool result() const { return m_result; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressbranchmayexitduetoobjectorotherusekindjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js (0 => 183310)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js 2015-04-25 15:43:45 UTC (rev 183310)
</span><span class="lines">@@ -0,0 +1,46 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Regression test for https://bugs.webkit.org/show_bug.cgi?id=144152
+
+// The bug in 144152 needs 3 conditions to manifest:
+// 1. The branch test value in the inlined function is of useKind ObjectOrOtherUse.
+// 2. The branch test value is proven to be a known useKind.
+// 3. The masqueradesAsUndefined watchpoint is no longer valid.
+// With the bug fixed, this test should not crash on debug builds.
+
+function inlinedFunction(x) {
+ if (x) // Conditional branch that will assert on a debug build if the bug is present.
+ new Object;
+}
+
+function foo(x) {
+ if (x) // Testing x before calling the inlined function sets up condition 2.
+ inlinedFunction(x);
+}
+
+makeMasquerader(); // Invalidates the masqueradesAsUndefined watchpoint for condition 3.
+for (var i = 0; i < 10000; i++)
+ foo({}); // Pass an object argument to set up condition 1.
</ins></span></pre>
</div>
</div>
</body>
</html>