Bug 109388
| Summary: | Implicit type check on local variables hoisting is unsound with respect to CFG simplification | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> |
| Component: | JavaScriptCore | Assignee: | Filip Pizlo <fpizlo> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | All | ||
| OS: | All | ||
| Bug Depends on: | 109371, 110433 | ||
| Bug Blocks: | |||
Filip Pizlo
We may hoist int, number, cell, or boolean checks into SetLocals. But we do so implicitly - the SetLocal doesn't "know" that it has this check; the CFA and the backend end up just deciding to put checks there without telling anyone else. So, if you CFG simplify and get rid of a SetLocal that had a type check that you had used to construct some proof, then you're going to have a really bad time.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Filip Pizlo
The best way to solve this is to explicitly have the Fixup phase shove type checks into Phantom nodes with appropriate Edges that are just above the SetLocal. Then CFG simplification will be able to "just work" and not worry about this. This of course relies on https://bugs.webkit.org/show_bug.cgi?id=109371.
Filip Pizlo
My current approach to fixing this is to handle it as part of DCE hardening.
*** This bug has been marked as a duplicate of bug 109389 ***