Skip to content

Conversation

@meg-gupta
Copy link
Contributor

@meg-gupta meg-gupta commented Jan 17, 2018

Fixes OS#15189393

Example:

  invariantSym = ..[]; // non object value type

  landingPad :

  loopTop :

     = LdElem[invariantSym + ...] // non-object value type in first pass, object value type in second pass
     = LdFld[invariantSym...] // object value type

  loopEnd

invariantSym is invariant in this loop, for some reason if we fail to hoist the LdFld, then assert saying valueInfos are incompatible will fire, when we try to hoist the LdElem.
Because optimization of LdFld will force combine the valuetype of invariantSym with Object, and in the second pass while optimizing LdElem in HoistInvariantValueInfo,
we will call ChangeValueInfo and this assert will fire.
This is because we are trying to change a non-object valuetype to an object valuetype.
AreValueTypesCompatible function converts to definite valuetypes before checking if they are compatible.
The check doesn't care if both of them are likely.

Globopt calls ChangeValueInfo with allowIncompatiblyTypes set to false in most cases where we are transforming specific to generic/generic to specific like Typespecialization etc.
It calls ChangeValueInfo with allowIncompatiblyTypes set to true, where we can expect incompatible types ex: UpdateObjPtrValueInfo.

This fix calls ChangeValueInfo from HoistInvariantValueInfo with allowIncompatiblyTypes set to true.

Fixes OS#15189393

Example:

  confusedSym = ..[]; // non object value type

  landingPad :

  loopTop :

     = LdElem[confusedSym + ...] // non-object value type in first pass, object value type in second pass
     = LdFld[confusedSym...] // object value type

  loopEnd

  confusedSym is invariant in this loop, for some reason if we fail to hoist the LdFld, then this assert will fire when we try to hoist the LdElem.
  Because optimization of LdFld will force combine the valuetype of confusedSym with Object, and in the second pass while optimizing LdElem in HoistInvariantValueInfo,
  we will call ChangeValueInfo and this assert will fire.
  This is because we are trying to change a non-object valuetype to an object valuetype.
  AreValueTypesCompatible function converts to definite valuetypes before checking if they are compatible.
  The check doesn't care if both of them are likely.

  Globopt calls ChangeValueInfo with allowIncompatiblyTypes set to false in most cases where we are transforming specific to generic/generic to specific like Typespecialization etc.
  It calls ChangeValueInfo with allowIncompatiblyTypes set to true, where we can expect incompatible types ex: UpdateObjPtrValueInfo.

  This fix calls ChangeValueInfo from HoistInvariantValueInfo with allowIncompatiblyTypes set to true.
@meg-gupta meg-gupta requested review from LouisLaf and pleath January 17, 2018 23:32
Copy link
Collaborator

@LouisLaf LouisLaf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@chakrabot chakrabot merged commit 175c13c into chakra-core:release/1.8 Jan 18, 2018
chakrabot pushed a commit that referenced this pull request Jan 18, 2018
…InvariantValueInfo

Merge pull request #4567 from meg-gupta:lossenGlobOptAssert

Fixes OS#15189393

Example:
```
  invariantSym = ..[]; // non object value type

  landingPad :

  loopTop :

     = LdElem[invariantSym + ...] // non-object value type in first pass, object value type in second pass
     = LdFld[invariantSym...] // object value type

  loopEnd
```
  invariantSym is invariant in this loop, for some reason if we fail to hoist the LdFld, then assert saying valueInfos are incompatible will fire, when we try to hoist the LdElem.
  Because optimization of LdFld will force combine the valuetype of invariantSym with Object, and in the second pass while optimizing LdElem in HoistInvariantValueInfo,
  we will call ChangeValueInfo and this assert will fire.
  This is because we are trying to change a non-object valuetype to an object valuetype.
  AreValueTypesCompatible function converts to definite valuetypes before checking if they are compatible.
  The check doesn't care if both of them are likely.

  Globopt calls ChangeValueInfo with allowIncompatiblyTypes set to false in most cases where we are transforming specific to generic/generic to specific like Typespecialization etc.
  It calls ChangeValueInfo with allowIncompatiblyTypes set to true, where we can expect incompatible types ex: UpdateObjPtrValueInfo.

  This fix calls ChangeValueInfo from HoistInvariantValueInfo with allowIncompatiblyTypes set to true.
chakrabot pushed a commit that referenced this pull request Jan 18, 2018
…from HoistInvariantValueInfo

Merge pull request #4567 from meg-gupta:lossenGlobOptAssert

Fixes OS#15189393

Example:
```
  invariantSym = ..[]; // non object value type

  landingPad :

  loopTop :

     = LdElem[invariantSym + ...] // non-object value type in first pass, object value type in second pass
     = LdFld[invariantSym...] // object value type

  loopEnd
```
  invariantSym is invariant in this loop, for some reason if we fail to hoist the LdFld, then assert saying valueInfos are incompatible will fire, when we try to hoist the LdElem.
  Because optimization of LdFld will force combine the valuetype of invariantSym with Object, and in the second pass while optimizing LdElem in HoistInvariantValueInfo,
  we will call ChangeValueInfo and this assert will fire.
  This is because we are trying to change a non-object valuetype to an object valuetype.
  AreValueTypesCompatible function converts to definite valuetypes before checking if they are compatible.
  The check doesn't care if both of them are likely.

  Globopt calls ChangeValueInfo with allowIncompatiblyTypes set to false in most cases where we are transforming specific to generic/generic to specific like Typespecialization etc.
  It calls ChangeValueInfo with allowIncompatiblyTypes set to true, where we can expect incompatible types ex: UpdateObjPtrValueInfo.

  This fix calls ChangeValueInfo from HoistInvariantValueInfo with allowIncompatiblyTypes set to true.
chakrabot pushed a commit that referenced this pull request Jan 18, 2018
… when called from HoistInvariantValueInfo

Merge pull request #4567 from meg-gupta:lossenGlobOptAssert

Fixes OS#15189393

Example:
```
  invariantSym = ..[]; // non object value type

  landingPad :

  loopTop :

     = LdElem[invariantSym + ...] // non-object value type in first pass, object value type in second pass
     = LdFld[invariantSym...] // object value type

  loopEnd
```
  invariantSym is invariant in this loop, for some reason if we fail to hoist the LdFld, then assert saying valueInfos are incompatible will fire, when we try to hoist the LdElem.
  Because optimization of LdFld will force combine the valuetype of invariantSym with Object, and in the second pass while optimizing LdElem in HoistInvariantValueInfo,
  we will call ChangeValueInfo and this assert will fire.
  This is because we are trying to change a non-object valuetype to an object valuetype.
  AreValueTypesCompatible function converts to definite valuetypes before checking if they are compatible.
  The check doesn't care if both of them are likely.

  Globopt calls ChangeValueInfo with allowIncompatiblyTypes set to false in most cases where we are transforming specific to generic/generic to specific like Typespecialization etc.
  It calls ChangeValueInfo with allowIncompatiblyTypes set to true, where we can expect incompatible types ex: UpdateObjPtrValueInfo.

  This fix calls ChangeValueInfo from HoistInvariantValueInfo with allowIncompatiblyTypes set to true.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants