[MERGE chakra-core#647] Fixing a subtle Switch Opt Assert

satheeshravi · satheeshravi · commit 359bcf73f7c8 · 2016-03-25T16:57:34.000-07:00
Merge pull request chakra-core#647 from satheeshravi:bugFix1 Issue: The interpreter profiles the switch expression as a string. But the globopt sees the value of the expression as an Integer, due to effects of constant folding and BailOnNoProfile. Fix: When such incompatibility is seen, we do a compile time rejit. This is already done when we have a sym. But we were just asserting for this in constant folding path.
diff --git a/lib/Backend/GlobOpt.cpp b/lib/Backend/GlobOpt.cpp
@@ -8988,7 +8988,11 @@ GlobOpt::OptConstFoldUnary(
     case Js::OpCode::Ld_A:
         if (instr->HasBailOutInfo())
         {
-            Assert(instr->GetBailOutKind() == IR::BailOutExpectingInteger);
+            //The profile data for switch expr can be string and in GlobOpt we realize it is an int.
+            if(instr->GetBailOutKind() == IR::BailOutExpectingString)
+            {
+                throw Js::RejitException(RejitReason::DisableSwitchOptExpectingString);
+            }
             instr->ClearBailOutInfo();
         }
         value = intConstantValue;

Original file line number	Diff line number	Diff line change
`@@ -8988,7 +8988,11 @@ GlobOpt::OptConstFoldUnary(`
`8988`	`8988`	`case Js::OpCode::Ld_A:`
`8989`	`8989`	`if (instr->HasBailOutInfo())`
`8990`	`8990`	`{`
`8991`		`- Assert(instr->GetBailOutKind() == IR::BailOutExpectingInteger);`
	`8991`	`+ //The profile data for switch expr can be string and in GlobOpt we realize it is an int.`
	`8992`	`+ if(instr->GetBailOutKind() == IR::BailOutExpectingString)`
	`8993`	`+ {`
	`8994`	`+ throw Js::RejitException(RejitReason::DisableSwitchOptExpectingString);`
	`8995`	`+ }`
`8992`	`8996`	`instr->ClearBailOutInfo();`
`8993`	`8997`	`}`
`8994`	`8998`	`value = intConstantValue;`