'[Webkit-unassigned] [Bug 148649] New: DFG AI assertions about not having to do type checks at the po'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       webkit-unassigned
Subject:    [Webkit-unassigned] [Bug 148649] New: DFG AI assertions about not having to do type checks at the po
From:       bugzilla-daemon () webkit ! org
Date:       2015-08-31 22:10:33
Message-ID: bug-148649-2851 () https ! bugs ! webkit ! org/
[Download RAW message or body]

--1441059019.DCEdFAF0.13301
Date: Mon, 31 Aug 2015 15:10:19 -0700
MIME-Version: 1.0
Content-Type: text/plain

https://bugs.webkit.org/show_bug.cgi?id=148649

            Bug ID: 148649
           Summary: DFG AI assertions about not having to do type checks
                    at the point of a Known use kind are unsound
    Classification: Unclassified
           Product: WebKit
           Version: Other
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned@lists.webkit.org
          Reporter: fpizlo@apple.com

We often generate IR like:

Check(Int32:@x)
...
Foo(KnownInt32:@x)

It would be valid for any optimization that somehow proves the type of @x to remove \
the Check node entirely.  But then, AI might fail on an assertion at Foo() because of \
the KnownInt32 use kind, if AI isn't smart enough to construct the same proof that \
the former optimization used for removing the Check.

The correct solution is probably to remove the compile-time assertions about Known \
use kinds having already been checked.  It's OK for those to be debug-only JIT \
assertions.

-- 
You are receiving this mail because:
You are the assignee for the bug.
--1441059019.DCEdFAF0.13301
Date: Mon, 31 Aug 2015 15:10:19 -0700
MIME-Version: 1.0
Content-Type: text/html

<html>
    <head>
      <base href="https://bugs.webkit.org/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - DFG AI assertions about not having to do type checks at the point of \
a Known use kind are unsound"  \
href="https://bugs.webkit.org/show_bug.cgi?id=148649">148649</a>  </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>DFG AI assertions about not having to do type checks at the point of a \
Known use kind are unsound  </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>WebKit
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>Other
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>Normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P2
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>JavaScriptCore
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>webkit-unassigned&#64;lists.webkit.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>fpizlo&#64;apple.com
          </td>
        </tr></table>
      <p>
        <div>
        <pre>We often generate IR like:

Check(Int32:&#64;x)
...
Foo(KnownInt32:&#64;x)

It would be valid for any optimization that somehow proves the type of &#64;x to \
remove the Check node entirely.  But then, AI might fail on an assertion at Foo() \
because of the KnownInt32 use kind, if AI isn't smart enough to construct the same \
proof that the former optimization used for removing the Check.

The correct solution is probably to remove the compile-time assertions about Known \
use kinds having already been checked.  It's OK for those to be debug-only JIT \
assertions.</pre>  </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
    </body>
</html>
--1441059019.DCEdFAF0.13301--

_______________________________________________
webkit-unassigned mailing list
webkit-unassigned@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-unassigned

[prev in list] [next in list] [prev in thread] [next in thread] 