nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/dfg-force-exit-then-sparse-...

10 lines
310 B
Plaintext
Raw Permalink Normal View History

DFG CFA may get overzealous in loops that have code that must exit https://bugs.webkit.org/show_bug.cgi?id=91188 Source/JavaScriptCore: Reviewed by Gavin Barraclough. Ensure that if the CFA assumes that an operation must exit, then it will always exit no matter what happens after. That's necessary to preserve soundness. Remove a broken fixup done by the DFG simplifier, where it was trying to say that the variable-at-head was the first access in the second block in the merge, if the first block did not read the variable. That's totally wrong, if the first block was in fact doing a phantom read. I removed that fixup and instead hardened the rest of the compiler. * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::endBasicBlock): * dfg/DFGBasicBlock.h: (JSC::DFG::BasicBlock::BasicBlock): (BasicBlock): * dfg/DFGCFAPhase.cpp: (JSC::DFG::CFAPhase::performBlockCFA): * dfg/DFGCFGSimplificationPhase.cpp: (JSC::DFG::CFGSimplificationPhase::mergeBlocks): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase): (JSC::DFG::ConstantFoldingPhase::run): (ConstantFoldingPhase): (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode): * dfg/DFGVariableEventStream.cpp: (JSC::DFG::VariableEventStream::reconstruct): LayoutTests: Reviewed by Gavin Baraclough. * fast/js/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop-expected.txt: Added. * fast/js/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop.html: Added. * fast/js/script-tests/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop.js: Added. (foo): Canonical link: https://commits.webkit.org/109014@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@122541 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-07-13 05:31:05 +00:00
Checks that increased aggressiveness in sparse conditional constant propagation resultin from a node being proven to be force exit does not lead to a cascade of unsound decisions.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
fourthTier: don't insert ForceOSRExits except for inadequate coverage https://bugs.webkit.org/show_bug.cgi?id=117363 Source/JavaScriptCore: Reviewed by Mark Hahnenberg. Previously (in http://trac.webkit.org/changeset/151303) I made it so that we inserted ForceOSRExits more eagerly. I now think it's better to have contradictions execute normally and exit with full OSR exit profiling. It's better at catching the few cases where the DFG will end up with different types than the baseline engines. This simplifies a bunch of code. For example it gets rid of ConstantFoldingPhase::paintUnreachableCode(). You can think of this as a partial roll-out of r151303, except that it uses the facilities introduced by that patch to give us run-time assertions that check the CFA's correctness: if the CFA thought that something was a contradiction but the code didn't exit, we'll now trap. * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::AbstractState): (JSC::DFG::AbstractState::startExecuting): (JSC::DFG::AbstractState::executeEffects): (JSC::DFG::AbstractState::execute): (JSC::DFG::AbstractState::filter): (JSC::DFG::AbstractState::filterArrayModes): (JSC::DFG::AbstractState::filterByValue): (DFG): * dfg/DFGAbstractState.h: (AbstractState): (JSC::DFG::AbstractState::filter): (JSC::DFG::AbstractState::filterArrayModes): (JSC::DFG::AbstractState::filterByValue): * dfg/DFGCFAPhase.cpp: (JSC::DFG::CFAPhase::performBlockCFA): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::run): (JSC::DFG::ConstantFoldingPhase::foldConstants): (ConstantFoldingPhase): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::compileNode): LayoutTests: Reviewed by Mark Hahnenberg. Convert this test, since this was the test originally added for ConstantFoldingPhase::paintUnreachableCode(). I wanted to make sure that I had good coverage for this since I am removing that method. * fast/js/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop-expected.txt: * fast/js/script-tests/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop.js: Canonical link: https://commits.webkit.org/136999@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@153215 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-07-25 04:02:17 +00:00
Passed some tests silently.
DFG CFA may get overzealous in loops that have code that must exit https://bugs.webkit.org/show_bug.cgi?id=91188 Source/JavaScriptCore: Reviewed by Gavin Barraclough. Ensure that if the CFA assumes that an operation must exit, then it will always exit no matter what happens after. That's necessary to preserve soundness. Remove a broken fixup done by the DFG simplifier, where it was trying to say that the variable-at-head was the first access in the second block in the merge, if the first block did not read the variable. That's totally wrong, if the first block was in fact doing a phantom read. I removed that fixup and instead hardened the rest of the compiler. * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::endBasicBlock): * dfg/DFGBasicBlock.h: (JSC::DFG::BasicBlock::BasicBlock): (BasicBlock): * dfg/DFGCFAPhase.cpp: (JSC::DFG::CFAPhase::performBlockCFA): * dfg/DFGCFGSimplificationPhase.cpp: (JSC::DFG::CFGSimplificationPhase::mergeBlocks): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase): (JSC::DFG::ConstantFoldingPhase::run): (ConstantFoldingPhase): (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode): * dfg/DFGVariableEventStream.cpp: (JSC::DFG::VariableEventStream::reconstruct): LayoutTests: Reviewed by Gavin Baraclough. * fast/js/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop-expected.txt: Added. * fast/js/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop.html: Added. * fast/js/script-tests/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop.js: Added. (foo): Canonical link: https://commits.webkit.org/109014@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@122541 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-07-13 05:31:05 +00:00
TEST COMPLETE