AI rule for MultiPutByOffset executes its effects in the wrong order
https://bugs.webkit.org/show_bug.cgi?id=189757
<rdar://problem/43535257>
Reviewed by Michael Saboff.
JSTests:
* stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
(foo):
(Foo):
(g):
Source/JavaScriptCore:
The AI rule for MultiPutByOffset was executing effects in the wrong order.
It first executed the transition effects and the effects on the base, and
then executed the filtering effects on the value being stored. However, you
can end up with the wrong type when the base and the value being stored
are the same. E.g, in a program like `o.f = o`. These effects need to happen
in the opposite order, modeling what happens in the runtime executing of
MultiPutByOffset.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@236223 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JSTests/stress/multi-put-by-offset-must-filter-value-before-filtering-base.js b/JSTests/stress/multi-put-by-offset-must-filter-value-before-filtering-base.js
new file mode 100644
index 0000000..b623e04
--- /dev/null
+++ b/JSTests/stress/multi-put-by-offset-must-filter-value-before-filtering-base.js
@@ -0,0 +1,25 @@
+//@ runDefault("--collectContinuously=1", "--useConcurrentJIT=0", "--useConcurrentGC=1")
+
+function foo(oo) {
+ oo.x = 4;
+ oo.y = 4;
+ oo.e = oo;
+ oo.e = 7;
+ oo.f = 8;
+}
+noInline(foo);
+
+function Foo() {
+ foo(this);
+}
+
+for (var i = 0; i < 100000; i++) {
+ g();
+}
+
+function g(){
+ foo({f:8});
+ new Foo();
+ new Foo();
+ new Foo();
+}
