[Webkit-unassigned] [Bug 264078] New: Abstract Interpreter computes wrong value for GetLocal

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=264078

            Bug ID: 264078
           Summary: Abstract Interpreter computes wrong value for GetLocal
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

=================test.js==================
function f0() {
  function f4() {
    return f4;
  }
  for (let v23 = 0; v23 < 10; v23++) {
    print(v23)
    function f24(a25, ...a26) {
      const v27 = [...a26];
      for (let v28 = 0; v28 < 100; v28++) {}
      v27.hasInstance;
    }
    f24();
  }
  f4();
}


for (let v32 = 0; v32 < 10; v32++) {
  f0();
}
==========================================

Run args: ./jsc -f test.js --useConcurrentJIT=0  --jitPolicyScale=0

JSC always prints '0' for `v23`. Actually, v23 is 0~9.

This bug may be related to Abstract Interpreter and DFG constant folding.

Abstract Interpreter computes wrong value for node GetLocal.
DFGAbstractInterpreterInlines.h
```
    case GetLocal: {
        VariableAccessData* variableAccessData = node->variableAccessData();
        AbstractValue value = m_state.operand(variableAccessData->operand()); // value=0, because of a SetLocal before the GetLocal
        DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(variableAccessData->flushFormat())));
        if (value.value())
            m_state.setShouldTryConstantFolding(true);
        setForNode(node, value);
        break;
    }
    ...
    case SetLocal: {
        m_state.operand(node->operand()) = forNode(node->child1());
        break;
    }
```
However, the value of GetLocal can be modified by SetLocal after the GetLocal becuase of the loop back edge, but AI ignores this situation.
In this way, DFG constant folding converts GetLocal to PhantomLocal and Constant.
DFGConstantFoldingPhase.cpp
```
            FrozenValue* value = m_graph.freeze(m_state.forNode(node).value())；//value=0
            if (!*value)
                continue;

            if (node->op() == GetLocal) {
                m_insertionSet.insertNode(
                    indexInBlock, SpecNone, PhantomLocal, node->origin,
                    OpInfo(node->variableAccessData()));
                m_graph.dethread();
            } else
                m_insertionSet.insertCheck(m_graph, indexInBlock, node);
            m_graph.convertToConstant(node, value); // constant 0 
```

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20231102/17656e38/attachment.htm>