<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - DFG::LICMPhase shouldn't hoist type checks unless it knows that the check will succeed at the loop pre-header"
href="https://bugs.webkit.org/show_bug.cgi?id=144527">144527</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>DFG::LICMPhase shouldn't hoist type checks unless it knows that the check will succeed at the loop pre-header
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>528+ (Nightly build)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>fpizlo@apple.com
</td>
</tr></table>
<p>
<div>
<pre>If a node has a type check - even something like a CheckStructure - then we should
only hoist the node if we know that it will execute on every loop iteration or if we know
that the type check will always succeed at the loop pre-header through some other means
(like looking at prediction propagation results). Otherwise, we might make a mistake like
this:
var o = ...; // sometimes null and sometimes an object with structure S1.
for (...) {
if (o)
... = o.f; // CheckStructure and GetByOffset, which we will currently hoist.
}
When we encounter such code, we'll hoist the CheckStructure and GetByOffset and then we
will have a recompile. We'll then end up thinking that the get_by_id needs to be
polymorphic, which is false.
We can counter this by either having a control flow equivalence check, or by consulting
prediction propagation to see if the check would always succeed. Prediction propagation
would not be enough for things like:
var p = ...; // some boolean predicate
var o = {};
if (p)
o.f = 42;
for (...) {
if (p)
... = o.f;
}
Prediction propagation can't tell us anything about the structure, and the CheckStructure
will appear to be hoistable because the loop doesn't clobber structures. The cell check
in the CheckStructure will be hoistable though, since prediction propagation can tell us
that o is always SpecFinalObject. In cases like this, control flow equivalence is the
only effective guard.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>