Summary:
Release notes: landing two previously reverted PRs
I found the issue.
Flow doesn't support optional fields in classes. This effectively becomes enforced with Babel 7 since it treats the type annotations as field initializers. Which means that these fields always gets created.
We happened to only use this newer plugin for class fields internally which broke our builds only there.
2b4546d Use `undefined` instead of missing to represent absent field in descriptors. Fixed all the callsites that checks for `hasOwnProperty` or `in` that I could find.
922d40c Fixes a Flow issue in the text printer.
I filed a [follow up issue for ObjectValue](https://github.com/facebook/prepack/issues/2510) since it has the same problem.
Pull Request resolved: https://github.com/facebook/prepack/pull/2511
Reviewed By: trueadm
Differential Revision: D9569949
Pulled By: sebmarkbage
fbshipit-source-id: f8bf84c4385de4f0ff6bcd45badacd3b8c88c533
Summary:
This fixes a bug it took me a while to track down. Unfortunately creating a repro was really difficult. I was observing the following invariant in `Reference` being triggered.
fddfc6f0c5/src/environment.js (L1425-L1431)
Digging in, the bad base was a deep conditional `AbstractValue` where all the leaf nodes were `EmptyValue` and `__bottomValue`. (Constructed from a number of `try`/`catch`/`throw`s.) This `AbstractValue` _should_ have simplified to just `EmptyValue` then `RequireObjectCoercible()` should have thrown a runtime `TypeError` after seeing the `EmptyValue`. This is what I observed in local tests when trying to reproduce this issue.
After looking at the error in the large React Native bundle I’m working in I discovered that the simplifier was throwing an error since the simplification count was exceeded. This is fine and normal. The issue was that `RequireObjectCoercible()` does not handle complex empty `AbstractValue`s well. If failing simplification is a normal part of Prepack operation we should make sure methods like `RequireObjectCoercible()` can handle complex `AbstractValue`s as well as simple ones.
This PR does that.
Pull Request resolved: https://github.com/facebook/prepack/pull/2515
Reviewed By: trueadm
Differential Revision: D9602146
Pulled By: calebmer
fbshipit-source-id: 359c74c646eeb619ba2e78b50eafe10b2e2fb133
Summary:
Release note: none
Closes#2435Closes#1829
Join.composeWithEffects composes a forked completion with subsequent effects. When two or more forks could end normally, this could result in shallow copies of the subsequent effects. These were then joined together and applied, so it was mostly OK. The generator of the subsequent effects, however, ended up being joined with itself and thus transformed the generator tree to a DAG, which is not desirable for the serializer.
The new approach is to extract a join condition from the forked completion and using it to join the subsequent effects with a newly constructed empty effects. The condition ensures that the subsequent effects are applied only in situations where the forked completion is not abrupt.
Extracting this condition makes for complicated abstract expressions and this uncovered some existing bugs and limitations that are also addressed in this pull request. As a side effect, path conditions are now longer and the time to compile unrolled loops with conditional abrupt completions inside their bodies has gone up so much that the unroll limit had to be lowered.
Please note that the expected output React tests has changed because of re-ordering. I'm none too sure that this re-ordering is necessarily benign, so please review carefully.
Pull Request resolved: https://github.com/facebook/prepack/pull/2460
Reviewed By: trueadm
Differential Revision: D9486135
Pulled By: hermanventer
fbshipit-source-id: 87147384c285e051542c277e41b3176b91ab165d
Summary:
Release note: none
This fixes two problems uncovered while debugging the failure of PR #2460 when run on a large internal test case:
1) CSE did not fix up recently introduced aliases of expressions.
2) The serializer logic visited array elements that were not visited because of recently introduced leak logic.
Pull Request resolved: https://github.com/facebook/prepack/pull/2516
Differential Revision: D9599235
Pulled By: hermanventer
fbshipit-source-id: a2047227b4aa2e0e2def7d8e7ebe0724a9525160
Summary:
Highlights:
Make simplification more robust when complexity limits are reached
reduces loop iteration counter to 6 before bailing out
We weren’t using the correct `initializerAstNodeName` in two places
Tease apart expressions vs. statements for operation descriptors
Simplify equality expressions where types are known
Refactor AbstractObjectValue to use evaluateWithAbstractConditional
Allow invalid render return values in the React reconciler
update Babel 7 to stable release
Speed up simplifier by using an implication cache per path branch
Add basic support for throws in React
Reviewed By: hermanventer
Differential Revision: D9597756
fbshipit-source-id: 6009ddb70f8b68151bf26ac8c15320213f67dcfc
Summary:
The following example fails with an invariant:
```js
try {
try {
const b = __abstract("boolean", "false");
if (b) throw new Error("throw");
} catch (error) {}
} catch (error) {
console.log(error.message);
}
```
```
Invariant Violation: assuming that false equals true is asking for trouble
debug-fb-www.js:208
This is likely a bug in Prepack, not your code. Feel free to open an issue on GitHub.
at invariant (/Users/calebmer/prepack/src/invariant.js:18:15)
at PathImplementation.withCondition (/Users/calebmer/prepack/src/utils/paths.js:132:17)
at joinTryBlockWithHandlers (/Users/calebmer/prepack/src/evaluators/TryStatement.js:81:35)
at _default (/Users/calebmer/prepack/src/evaluators/TryStatement.js:30:47)
at LexicalEnvironment.evaluateAbstract (/Users/calebmer/prepack/src/environment.js:1379:20)
at LexicalEnvironment.evaluate (/Users/calebmer/prepack/src/environment.js:1367:20)
at LexicalEnvironment.evaluateCompletion (/Users/calebmer/prepack/src/environment.js:1102:19)
at LexicalEnvironment.evaluateCompletionDeref (/Users/calebmer/prepack/src/environment.js:1095:23)
at _default (/Users/calebmer/prepack/src/evaluators/Program.js:235:17)
at LexicalEnvironment.evaluateAbstract (/Users/calebmer/prepack/src/environment.js:1379:20)
```
What happens is we end up with a completion structure as follows when going into the outer `catch`:
```
- JoinedNormalAndAbrubtCompletions (joinCondition = x)
- SimpleNormalCompletion
- JoinedNormalAndAbrubtCompletions (joinCondition = x)
- ThrowCompletion
- SimpleNormalCompletion
```
The inner `JoinedNormalAndAbrubtCompletions` is the inner `try` block completion. The outer `JoinedNormalAndAbrubtCompletions` is the join of the inner `try`/`catch` blocks. Notably the `ThrowCompletion` is completely unreachable. However it is still there.
Ideally we would refine the completions. I tried this, but realized the `composedWith`, `pathConditionsAtCreation`, and `savedEffects` on `JoinedNormalAndAbrubtCompletions` were more to handle then I originally bargained for to fix my original test case. Instead I picked a simple fix for this specific case of `try`/`catch`. When we `AbstractValue.createJoinConditionForSelectedCompletions` we get a concrete `false` value. So I check if it is false and don’t execute the catch block if it is. The condition can never be concretely true. Otherwise we’d unconditionally catch an error in the block above.
Happy to take suggestions for a more general fix.
Pull Request resolved: https://github.com/facebook/prepack/pull/2507
Differential Revision: D9583244
Pulled By: calebmer
fbshipit-source-id: 7693efef5e967c90d5a4c54f10ef2c137f264ef8
Summary:
Release notes: none
Looking through our internal bundles and there are frequent cases where `instanceof` is used where the left-hand side is a primitive and the right-hand side is an abstract value. In the case where the left-hand side is a primitive and the right-hand side is a simple object, the instanceof binary expression should always return `false`.
Pull Request resolved: https://github.com/facebook/prepack/pull/2506
Differential Revision: D9567344
Pulled By: trueadm
fbshipit-source-id: 7333f3b81627657c184c77d4cfffd4511bee0cbf
Summary:
Starts adding basic support for throws in React. Concretely there are three things this PR does outside of adding tests:
1. Allowing throw side-effects.
2. Removing an invalid invariant. `createdObjects` changes after calling `realm.captureEffects()` and this is expected. Later code which joins/incorporates effects will merge in the captured `createdObjects`.
3. Don’t catch `AbruptCompletion`s and handle them as errors. Instead let them propagate up to the nearest `realm.evaluateForEffects()`. (Or similar function.)
I have not run this against the internal web bundle yet. Against the internal React Native bundle we get pretty far without removing throws with these changes.
Pull Request resolved: https://github.com/facebook/prepack/pull/2502
Reviewed By: trueadm
Differential Revision: D9566580
Pulled By: calebmer
fbshipit-source-id: 3716a6afd5fc3ae824182ee50e38e51d72126dc2
Summary:
Release notes: none
Fixes mixing functionality from React.cloneElement, where the original ReactElement props where missing from being copied to the new props.
Pull Request resolved: https://github.com/facebook/prepack/pull/2505
Differential Revision: D9565338
Pulled By: trueadm
fbshipit-source-id: f04c15b3a640f87de6de8326511e8e4bdfa328a7
Summary:
Release notes: None
This resolves#1944.
The functionality that Prepack provides can be seen as being done by two separate engines:
1) There's the "front-end", which does symbolic execution / abstract interpretation,
computing "effects" / "generator trees" for the global code and optimized functions.
2) There's the "back-end", which takes this intermediate representation, computes what's
reachable, and then turns it into a new executable program by performing transformations
such as breaking cycles.
Before, Prepack developers had very few tools available to understand what goes on between the
front-end and back-end. Usually, they just look at the final output, imagine what the
intermediate representation might have been, or maybe use to debugger to poke around
memory locations, or to invoke helper functions to inspect live state that way, hoping the debugger doesn't crash along the way.
This PR (and other associated PRs such as #2490, #2491) try to improve that state by turning the intermediate representation into a first-class data structure that is printable into a human-readable textual form. This will help...
- in understanding what's going on
- enabling different back-ends by ensuring that there's a first-class intermediate representation
- enabling future transformations on a well-defined intermediate data structure, ideally breaking up what the current serializer implementation does
- new ways of testing, e.g. via snapshots of the intermediate representation, or
(once there is a parser) feeding hand-written IR into the back-end
For example, for this program...
```js
let x = __abstract("number", "(x)");
if (x > 42) {
let t = Date.now();
let u = 2 + 3
console.log(t + u);
} else {
global.result = x;
}
```
... the IR would currently look like this:
```
(entry point): "main(#0)"
* value#0 = ">"(@"(x)", 42)
if value#0
then: "evaluateNodeForEffects(#4)"
path conditions value#0
_$0 := ABSTRACT_FROM_TEMPLATE<template source @"global.Date.now()">[isPure]
* value#1 = "+"(5, _$0)
CONSOLE_LOG("log", value#1)
else: "evaluateNodeForEffects(#11)"
* value#2 = "!"(value#0)
path conditions value#2
GLOBAL_ASSIGNMENT(@"(x)", "result")
```
Notes:
- Indentation reflects structure of the generator tree
- Each line encodes some information. Some of the information is atemporal, e.g.
- `* value#N = f(args)` // atemporal abstract value
- Some of the information is temporal, e.g.
- `_$N := op-type<op-data>(args)[metadata]` // generator entry that defines a temporal value
- `op-data` contains various essential data
- `args` tends to be a projection of `data` capturing all values that must be visited, but it's not consistent
- `metadata` is information that helps the visitor compute minimal reachability, but it's not semantically relevant.
- `op-type<op-data>(args)[metadata]` // generator entry that does not define a temporal value
- `if ... then ... else`.
```js
(function() {
let obj = {};
obj.p = obj;
global.result = obj;
})();
```
=>
```
(entry point): "main(#0)"
* object#14 = ObjectValue(properties [p], $Prototype @"Object.prototype")
* object#14.p = PropertyBinding(descriptor PropertyDescriptor(writable, enumerable, configurable, value object#14))
GLOBAL_ASSIGNMENT(object#14, "result")
```
Things get slightly ugly with functions.
```js
function f() { }
```
=>
```
(entry point): "main(#0)"
* declEnv#1 = DeclarativeEnvironmentRecord()
* globEnv#2 = GlobalEnvironmentRecord($DeclarativeRecord declEnv#1, $ObjectRecord declEnv#1, $VarNames [f], $GlobalThisValue global)
* lexEnv#0 = LexicalEnvironment(destroyed, environment record globEnv#2)
* func#13 = ECMAScriptSourceFunctionValue($ConstructorKind base, $ThisMode global, $FunctionKind normal, $FormalParameters 0, $Environment lexEnv#0, properties [arguments, length, caller, prototype, name], $Prototype @"Function.prototype")
* func#13.arguments = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value undefined))
* func#13.length = PropertyBinding(descriptor PropertyDescriptor(configurable, value 0))
* func#13.caller = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value undefined))
* object#14 = ObjectValue(properties [constructor], $Prototype @"Object.prototype")
* object#14.constructor = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value func#13))
* func#13.prototype = PropertyBinding(descriptor PropertyDescriptor(writable, value object#14))
* func#13.name = PropertyBinding(descriptor PropertyDescriptor(configurable, value "f"))
GLOBAL_ASSIGNMENT(func#13, "f")
```
Things get really ugly with optimized functions, but that's what it is right now:
```js
function f() { return 2 + 5; }
__optimize(f);
```
=>
```
(entry point): "main(#0)"
* declEnv#1 = DeclarativeEnvironmentRecord()
* globEnv#2 = GlobalEnvironmentRecord($DeclarativeRecord declEnv#1, $ObjectRecord declEnv#1, $VarNames [f], $GlobalThisValue global)
* lexEnv#0 = LexicalEnvironment(destroyed, environment record globEnv#2)
* func#13 = ECMAScriptSourceFunctionValue($ConstructorKind base, $ThisMode global, $FunctionKind normal, $FormalParameters 0, $Environment lexEnv#0, properties [arguments, length, caller, prototype, name], $Prototype @"Function.prototype")
* func#13.arguments = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value undefined))
* func#13.length = PropertyBinding(descriptor PropertyDescriptor(configurable, value 0))
* func#13.caller = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value undefined))
* object#15 = ObjectValue(properties [constructor], $Prototype @"Object.prototype")
* object#15.constructor = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value func#13))
* func#13.prototype = PropertyBinding(descriptor PropertyDescriptor(writable, value object#15))
* func#13.name = PropertyBinding(descriptor PropertyDescriptor(configurable, value "f"))
GLOBAL_ASSIGNMENT(func#13, "f")
=== optimized function func#13
(entry point): "AdditionalFunctionEffects(#12)"
RETURN(7)
* object#16 = ArgumentsExotic(properties [length, callee], symbols [@"Symbol.iterator"], $Prototype @"Object.prototype")
* object#16.length = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value 0))
* declEnv#1 = DeclarativeEnvironmentRecord()
* globEnv#2 = GlobalEnvironmentRecord($DeclarativeRecord declEnv#1, $ObjectRecord declEnv#1, $VarNames [f], $GlobalThisValue global)
* lexEnv#0 = LexicalEnvironment(destroyed, environment record globEnv#2)
* func#13 = ECMAScriptSourceFunctionValue($ConstructorKind base, $ThisMode global, $FunctionKind normal, $FormalParameters 0, $Environment lexEnv#0, properties [arguments, length, caller, prototype, name], $Prototype @"Function.prototype")
* func#13.arguments = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value undefined))
* func#13.length = PropertyBinding(descriptor PropertyDescriptor(configurable, value 0))
* func#13.caller = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value undefined))
* object#15 = ObjectValue(properties [constructor], $Prototype @"Object.prototype")
* object#15.constructor = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value func#13))
* func#13.prototype = PropertyBinding(descriptor PropertyDescriptor(writable, value object#15))
* func#13.name = PropertyBinding(descriptor PropertyDescriptor(configurable, value "f"))
* object#16.callee = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value func#13))
* object#16.@"Symbol.iterator" = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value @"Array.prototype.values"))
* object#16.$Prototype = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value @"Object.prototype"))
* object#16.$Extensible = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value true))
* object#16._isPartial = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#16._isLeaked = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#16._isSimple = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#16._simplicityIsTransitive = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#16._isFinal = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#17 = ObjectValue($Prototype null)
* object#17.$Prototype = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value null))
* object#17.$Extensible = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value true))
* object#17._isPartial = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#17._isLeaked = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#17._isSimple = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#17._simplicityIsTransitive = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#17._isFinal = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#18 = ObjectValue(properties [next], $Prototype @"([][Symbol.iterator]().__proto__.__proto__)")
* func#19 = NativeFunctionValue(properties [length, name], $Prototype @"Function.prototype")
* func#19.length = PropertyBinding(descriptor PropertyDescriptor(configurable, value 0))
* func#19.name = PropertyBinding(descriptor PropertyDescriptor(configurable, value "next"))
* object#18.next = PropertyBinding(descriptor PropertyDescriptor(writable, configurable, value func#19))
* object#18.$Prototype = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value @"([][Symbol.iterator]().__proto__.__proto__)"))
* object#18.$Extensible = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value true))
* object#18._isPartial = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#18._isLeaked = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#18._isSimple = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#18._simplicityIsTransitive = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#18._isFinal = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* object#18.$IteratedList = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(some array))
* func#19.$Prototype = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value @"Function.prototype"))
* func#19.$Extensible = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value true))
* func#19._isPartial = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* func#19._isLeaked = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* func#19._isSimple = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* func#19._simplicityIsTransitive = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
* func#19._isFinal = PropertyBinding(internal slot, descriptor InternalSlotDescriptor(value false))
modified property bindings: [object#16.$Prototype, object#16.$Extensible, object#16._isPartial, object#16._isLeaked, object#16._isSimple, object#16._simplicityIsTransitive, object#16._isFinal, object#17.$Prototype, object#17.$Extensible, object#17._isPartial, object#17._isLeaked, object#17._isSimple, object#17._simplicityIsTransitive, object#17._isFinal, object#16.length, object#16.@"Symbol.iterator", object#16.callee, object#18.$Prototype, object#18.$Extensible, object#18._isPartial, object#18._isLeaked, object#18._isSimple, object#18._simplicityIsTransitive, object#18._isFinal, object#18.$IteratedList, func#19.$Prototype, func#19.$Extensible, func#19._isPartial, func#19._isLeaked, func#19._isSimple, func#19._simplicityIsTransitive, func#19._isFinal, func#19.length, func#19.name, object#18.next]
created objects: [object#16, object#17, object#18, func#19]
result: SimpleNormalCompletion(value 7)
```
There are still a good number of things left to do. In particular:
- further simplify printing to make it more readable (and writable)
- further extend printed format to make it round-trippable
- some details of the current IR is really just an artefact of 2 years of hacking. It is in need of some additional
rounds of refactorings and simplifications.
- Particularly problematic / overly complicated are invariants INVARIANT, FULL_INVARIANT_ABSTRACT, FOR_IN, REACT_SSR_TEMPLATE_LITERAL
- In `TemporalOperationEntry`, there's some duplication going on with `args` and `data`. Consider eliminating `args` and deriving this information when needed from `data`.
- `OperationDescriptorData` could use some structure, or a (sub)type hierarchy.
- There are already dedicated generator entry classes for some operations, and then there is `TemporalOperationEntry` with its `data` dumping ground for everything else. This is all a bit arbitrary and should be unified.
- ...there's much more cruft.
In a way, this PR just provides yet another way of dumping values and generators. Some of the other existing ways should be consolidated or killed.
Added option --ir to test-runner to activate (and test) IR dumping.
Pull Request resolved: https://github.com/facebook/prepack/pull/2493
Differential Revision: D9560883
Pulled By: NTillmann
fbshipit-source-id: 70920c8e1b4139c69329d8f5ab6e6267a35f058b
Summary:
Release note: Speed up simplifier by using an implication cache per path branch
The realm's path conditions is now a class instances and an explicit tree, along with caches for expressions that have already been checked for true/false using Path.implies on the current set of path conditions.
The AbstractValueImplicationCounter is still there as flag, to be renamed later. It is no longer used as a global k-limit, but enables k-limits on the cost of constructing a new set of path conditions. When React is the target, path conditions are not re-specialized. This leads to a very nice performance win for the large React internal test.
A number of tweaks to the simplifier were needed to get tests to pass. Some of these were borrowed from PR #2460.
Pull Request resolved: https://github.com/facebook/prepack/pull/2494
Reviewed By: trueadm
Differential Revision: D9554820
Pulled By: hermanventer
fbshipit-source-id: 5fdc550499975fe11c0c954b9502cd4eeab2bafe
Summary:
Release notes: Refactor of joined descriptors. Expect a slight performance regression. Will fatal in more cases that we would previously silently possibly generate the wrong code.
Currently we have three types of property descriptors. 1) Descriptors used by internal slots. 2) Normal concrete descriptors. 3) Abstract joined descriptors.
These are all typed as arbitrary an inexact object where all the fields are optional. That means that essentially any object with any typo can be assigned to a descriptor.
We are also not forced to deal with the joined descriptor case. Almost everywhere we assume that joined descriptors are really just a generic descriptor object which doesn't have any attributes on it.
There are so many small bugs related to this so I figured it's time to start dealing with it.
This PR turns this inexact object into nominally typed PropertyDescriptor, AbstractJoinedDescriptor and InternalSlotDescriptor. Essentially the same model as values.
Thanks to this Flow forces me to ensure that I've covered all of these cases. I've dealt with it in the cases I figured I could figure it out and where it was necessary such as the serializer/join/widen. In all other cases where we don't know, I ensure that we throw a fatal error instead of assuming that a joined descriptor is an empty descriptor.
Pull Request resolved: https://github.com/facebook/prepack/pull/2473
Differential Revision: D9526419
Pulled By: sebmarkbage
fbshipit-source-id: 1d3556b2d4608c02ba2570651f4e6a765fa0eea6
Summary:
Release notes: None
- Fixing type of `quasis` in Babel and as field
- Instead of storing callTemplate as a derived function, store instead the source string (working towards having a human-readable generator intermediate format)
Pull Request resolved: https://github.com/facebook/prepack/pull/2490
Differential Revision: D9540696
Pulled By: NTillmann
fbshipit-source-id: d7ab8c68857d4b8b4e584894edb3781dce3db2b2
Summary:
Release notes: None
Instead of storing some obscure function in OperationDescriptorData, this makes it store the template source.
This brings us closer to the generator tree being an abstract intermediate format, and simplifies the code.
Pull Request resolved: https://github.com/facebook/prepack/pull/2491
Differential Revision: D9540484
Pulled By: NTillmann
fbshipit-source-id: 7ae86488c708c4e8e08490987437f18de9a70bd0
Summary:
gaearon found a regression to the cases I fixed in #2255. The following code:
```js
function fn1(arg) {
if (arg.foo()) {
if (arg.bar()) {
return 42;
}
}
}
function fn2(arg) {
if (arg.foo()) {
if (arg.bar()) {
return 1;
}
} else {
return 2;
}
}
if (global.__optimize) {
__optimize(fn1);
__optimize(fn2);
}
```
Now compiles to:
```js
var fn1, fn2;
(function() {
var _$4 = this;
var _0 = function(arg) {
var _$0 = arg.foo();
if (_$0) {
var _$1 = arg.bar();
}
if (_$0) {
var _$1 = arg.bar(); // <----------------------------- `arg.bar()` is redeclared.
}
return _$0 ? (_$1 ? 42 : void 0) : void 0;
};
var _8 = function(arg) {
var _$2 = arg.foo();
var _$3 = arg.bar(); // <------------------------------- `arg.bar()` should be inside `if (_$2)`
return _$2 ? (_$3 ? 1 : void 0) : 2;
};
_$4.fn1 = _0;
_$4.fn2 = _8;
}.call(this));
```
After looking through the commits, I found that #2274 regressed this case. After reverting that PR I found that these cases were fixed again, but interestingly the test added in that PR also passed after I reverted the change.
I’m opening this PR with the failing tests so hermanventer can take a look. I haven’t looked too deeply into this case, so I’m probably missing something important. Maybe some race condition between the landing of #2255 and #2274?
Pull Request resolved: https://github.com/facebook/prepack/pull/2288
Differential Revision: D9540424
Pulled By: calebmer
fbshipit-source-id: 3ef03068cb575617d64d73fdc1f9431188effdda
Summary:
Release notes: none
This unblocks an issue found in https://github.com/facebook/prepack/pull/2494.
After looking into https://github.com/facebook/prepack/pull/2494, which showed that without that PR, some conditions with `&&` weren't being passed correctly to the React reconciler to be properly inlined. With this PR applied however, this issue no longer occurs but we do run into another problem.
The React reconciler will attempt to evaluate, resolve and inline all paths. Typically, if a "value" that a React component returned wasn't that of a valid type (string, ReactElement, null and some other objects) we would throw an `ExpectedBailOut`. This turned out to break logic in common use-case though: `&&` conditions.
Take the below example though:
```js
function Child() {
return <div>This should be inlined</div>;
}
function App(props) {
var a = props.x ? null : function() {};
return a && <Child />;
}
```
In this case with, the React reconciler will see `function () {}` as one of the paths of the `&&` condition and try and inline all paths and hit the fact you can't return `function () {}` and throw the `ExpectedBailOut`.
The realism is that the React reconciler in Prepack is being too smart here. It doesn't need to be concerned with the fact that the valid might not be valid. If the result is not valid, then the user will hit a runtime issue with React with their original input too. Ultimately, all we need to do is return the valid.
There are three tests attached to this PR. Only `simple-24` is a direct test for the changes in this PR, `simple-22` and `simple-23` are regression tests for when https://github.com/facebook/prepack/pull/2494 is applied.
Pull Request resolved: https://github.com/facebook/prepack/pull/2498
Differential Revision: D9539852
Pulled By: trueadm
fbshipit-source-id: c5bba2b9315d7f2af5fdeb612f56e739a7aa2c23
Summary:
Release notes: this might increase code size slighty, if the simplifier isn't fully working, in the rare case of conditional objects. I haven't observed any cases of that happening.
_Reviewing the individual commits might be helpful._
The main motivation of these changes is to prepare to avoid leaking the inner object when AbstractObjectValue is wrapping a template which prevents us from modeling templates without true identity.
To do that we need to stop leaking it to the Receiver since the Receiver can be passed to user space. Currently, we unwrap abstract objects [we really need to stop that since it leaks the receiver](cf8184904e).
It used to be that we special cased simple cases in AbstractObjectValue but since OrdinarySet operations are pretty complex, sometimes it's a simple assignment and sometimes the receiver leaks to a more complex operation.
Additionally, we assume that all these operations in AbstractObjectValue can be expressed as pure operations because they're simple objects. However, that's not the case because in properties.js/get.js we emit generator entries for intrinsic objects, havoced objects, widened properties, etc. These are at the very least unnecessary operations to perform when the AbstractObjectValue is actually representing one of the other branches. However, in the case of havoced objects, we don't really know if it is a simple object so it can actually be observable side-effects.
The simplest way of dealing with all these issues is to simply deal with side-effectful operations. So I do that by evaluating each path for effects and joining the effects using the evaluateWithAbstractConditional helper. This also lets us deal with non-simple abstract objects as a bonus.
This doesn't fully get us all the way to no longer leaking receivers. In a follow up I plan to deal with defIneOwnProperty, getOwnProperty, and a few other operations that also leak the inner object template.
Pull Request resolved: https://github.com/facebook/prepack/pull/2461
Differential Revision: D9510853
Pulled By: sebmarkbage
fbshipit-source-id: 4e03b1fb5b168a68b70120630341056bbf5f0e57
Summary:
Fixes#2458.
This is a new version of my change in #2459. I closed that PR since hermanventer had doubts which I confirmed after discovering my “fix” crashed my React Native internal bundle in a different way demonstrating its incorrectness.
After thinking about how to workaround this issue (since I was blocked on this) and fixing related issue #2466 I think I have a proper fix and I’m ready to defend it.
Note that this PR is based on top of #2466. The changes in [this commit](4896087869) are the ones to look at.
The failing test case is the following. Annotated with some comments to help demonstrate the issue:
```js
if (!global.__evaluatePureFunction) global.__evaluatePureFunction = f => f();
const result = global.__evaluatePureFunction(() => {
let x, y, z;
function f() {
const getNumber = global.__abstract ? global.__abstract("function", "(() => 1)") : () => 1;
const b1 = global.__abstract ? global.__abstract("boolean", "true") : true;
const b2 = global.__abstract ? global.__abstract("boolean", "!false") : true;
const b3 = global.__abstract ? global.__abstract("boolean", "!!true") : true;
x = getNumber(); // Modify binding
if (!b1) throw new Error("abrupt"); // Compose JoinedNormalAndAbruptCompletions
y = getNumber(); // Modify binding
if (!b2) throw new Error("abrupt"); // Compose JoinedNormalAndAbruptCompletions
z = getNumber(); // Modify binding
if (!b3) throw new Error("abrupt"); // Compose JoinedNormalAndAbruptCompletions
if (global.__fatal) global.__fatal();
return x + y + z;
}
f();
return x + y + z;
});
global.inspect = () => result;
```
What is happening is that we modify three bindings in `f` before we throw a `FatalError`. `x`, `y`, and `z`. We also have three `JoinedNormalAndAbruptCompletions` since we’re using abstract booleans and throwing if the boolean is false. Our realm when we throw the `FatalError` ends up looking like:
```
Realm {
savedCompletion: JoinedNormalAndAbruptCompletions {
savedEffects: { modifiedBindings: { z } },
composedWith: JoinedNormalAndAbruptCompletions {
savedEffects: { modifiedBindings: { y } },
composedWith: JoinedNormalAndAbruptCompletions {
savedEffects: { modifiedBindings: { x } },
}
}
}
}
```
When we throw the `FatalError` we want to restore all our bindings to a state before we started the `evaluateForEffects()` call so that we can leave a residual call in pure scope. However, the way the code is currently written we _don’t look into `savedCompletion.composedWith`_ even though there may be more bindings there. Instead we only look at `savedCompletion` so we only restore the `z` binding.
My previous fix modified `stopEffectCaptureAndUndoEffects()` to chase `composedWith`, but that broke the contract of `stopEffectCaptureAndUndoEffects()` as hermanventer mentioned. So instead I updated the `finally` block in `evaluateForEffects()` which cleans up modified bindings of a `savedCompletion` (in case we throw in the middle of evaluation) to more explicitly clean up the bindings of the saved completion and all composed completions. This preserves and fixes our effect cleanup behavior without changing the meaning of `stopEffectCaptureAndUndoEffects()`.
hermanventer I know you mentioned you wanted to look at this issue, sorry if I’m stepping on your toes. Since I was blocked I thought a bit more about this issue and figured I was directionally correct, but the specific fix in #2459 was wrong. Also sorry for the PR churn. Thought I wasn’t going to come back to this issue.
Pull Request resolved: https://github.com/facebook/prepack/pull/2467
Differential Revision: D9498191
Pulled By: calebmer
fbshipit-source-id: 6b95df969b2230302d94342a392e9d8cb81329db
Summary:
Fixes#2432. I found this while trying to compile our internal React Native bundle.
Prepack was incorrectly cleaning up lexical scopes in the case of a stack overflow.
This bug is a bit difficult to reproduce. Follow these steps to reproduce:
1. Produce a stack overflow in code Prepack compiles. With a recursive loop for instance.
2. Wrap in `__evaluatePureFunction`. This should catch the stack overflow and emit a residual function call.
3. Add empty functions for `global.require` and `global.__d`. You need to do this so that we don’t crash [in tracer code trying to resolve these variables](c18bd7ee97/src/methods/function.js (L82-L90)) but we instead crash [in `PrepareForOrdinaryCall`](c18bd7ee97/src/methods/function.js (L100)).
I used a `try`/`catch` to fix this which is the obvious solution, but perhaps not the most efficient. Happy to write a slightly uglier solution for performance if we feel like it is necessary.
Pull Request resolved: https://github.com/facebook/prepack/pull/2433
Differential Revision: D9469599
Pulled By: calebmer
fbshipit-source-id: bd120c2e4bd450da3364c722550977d6566ed89a
Summary:
Release notes: None
Remove dead _callRequireAndAccelerate function
Remove dead isModuleInitialized function
Remove dead --accelerateUnsupportedRequires option
Deleting dead code around checking uniqueness of previousDependencies
Add global.__eagerlyRequireModuleDependencies helper to effectively disable lazy module initialization in a code block (needed for InstantRender, to avoid having to deal with conditionally defined modules when prepacking nested callbacks)
Pull Request resolved: https://github.com/facebook/prepack/pull/2482
Differential Revision: D9492955
Pulled By: NTillmann
fbshipit-source-id: 91fe30168ffa848502982e042772462530b982a5
Summary:
Release note: Simplify equality expressions where types are known
Fixes: #2317
If the types or the arguments are known we can simplify equality expressions involving different typed arguments to false in some cases.
Pull Request resolved: https://github.com/facebook/prepack/pull/2481
Differential Revision: D9491269
Pulled By: hermanventer
fbshipit-source-id: 4e5657e23d13fafa7d48adcf01a7626fa63a2328
Summary:
Fixes#2464.
When we bail out of a function call because of a `FatalError` we did not leak the function we called. This means modified bindings were not appropriately leaked. See issue #2464 where the result is `undefined` instead of a reference to the leaked value.
This PR also adds a utility `__fatal` function for throwing a fatal error. Allowing us to more clearly express issues involving `FatalError`s. Used in the test.
Pull Request resolved: https://github.com/facebook/prepack/pull/2466
Differential Revision: D9482612
Pulled By: calebmer
fbshipit-source-id: 792d29818245ad9f631227d923efb56228df21e0
Summary:
Fixes#2468.
We weren’t using the correct `initializerAstNodeName` in two places. Also some free small efficiency wins.
Pull Request resolved: https://github.com/facebook/prepack/pull/2469
Differential Revision: D9481902
Pulled By: calebmer
fbshipit-source-id: 07dd44ae0141a74c50296c61828706da11cd26d2
Summary:
Release notes: reduces loop iteration counter to 6 before bailing out
With our internal bundle, it takes far too long to hit the current limit of 12 with production code (gave up after 2 hours). This now takes a few minutes.
https://en.wikipedia.org/wiki/The_Magical_Number_Seven,_Plus_or_Minus_Two
Pull Request resolved: https://github.com/facebook/prepack/pull/2476
Differential Revision: D9480198
Pulled By: trueadm
fbshipit-source-id: cff1ef3a628dccfb9a5fb20d67169bd4a5174c0e
Summary:
Release note: Make simplification more robust when complexity limits are reached
Fixes#2361
Any particular simplification can fail because Prepack has run out of a global limit for allowable implications (set by the abstractValueImpliesMax option). If Prepack then recovers from from the exception and carries on, it may later do the same simplification and succeed. If this happens in a context where the now known result is not expected, there will be an invariant failure, as for example in the issue above.
The invariant useful for finding bugs when reasoning is precise, so I'm keeping it, but only if no limit was exceeded.
Pull Request resolved: https://github.com/facebook/prepack/pull/2472
Reviewed By: trueadm
Differential Revision: D9479598
Pulled By: hermanventer
fbshipit-source-id: c38c49257df1c1e207e01a24b92171e1125fe7c2
Summary:
After #2425 I ran into _another_ issue in the React Native internal bundle I’m working on involving `React.forwardRef()` where there was some `component instanceof Component.prototype` check where `component` is an abstract `React.forwardRef()` value. This caused a far-reaching undesirable havoc.
There are a lot of components in React Native that use `React.forwardRef()`. Basically all the primitives. `Text`, `Image`, etc.
The React implementation of the `React.forwardRef()` function is also pretty simple to boot. Let’s just return concrete values from `React.forwardRef()` instead of abstract values which cause a lot of problems. This depends on the React implementation not changing, but we’re already teaching Prepack about the React internal implementation.
f9358c51c8/packages/react/src/forwardRef.js (L12-L43)
Pull Request resolved: https://github.com/facebook/prepack/pull/2465
Differential Revision: D9467945
Pulled By: calebmer
fbshipit-source-id: 93aa24a994107a77f2975b9483b59edfc87f64f5
Summary: New alpha version for master.
Reviewed By: trueadm
Differential Revision: D9457284
fbshipit-source-id: 6b67e1095dc9bcd9545e88dcfa9a7d714434a9db
Summary:
What it says on the tin
Pull Request resolved: https://github.com/facebook/prepack/pull/2463
Differential Revision: D9456926
Pulled By: gaearon
fbshipit-source-id: fef96d4e0843662ff90eb4b0b06410f3b3bac83c
Summary:
Fixes#2419#2386#2439#2447#2432#2437#2442
* Fix havoced binding not in optimized function
* Allow arrays with widened numeric properties to update index properties
* Fix nested for statement bailout with nested for-in
* Don’t record modified bindings for immutable bindings when havocing
Reviewed By: trueadm, sebmarkbage
Differential Revision: D9456957
fbshipit-source-id: f266b8cc73012b9c721f0f9eebd48347bf0e37ae
Summary:
Fixes#2442 by not marking immutable bindings as modified. Its very possible that my fix is incorrect. There’s a bunch of related logic for `binding.hasLeaked`/`binding.mutable`/`modifiedBindings` and I certainly didn’t find them all to get a holistic view of what’s happening. From the code I did look at, this fix seems to be safe since there’s no way for a havoced function to change an immutable binding.
I ran into this issue while trying to compile our internal React Native bundle with the React Compiler.
Let me walk through this repro to the invariant.
```js
const havoc = __abstract("function", "(() => {})");
global.result = __evaluatePureFunction(() => {
const b = __abstract("boolean", "true");
if (b) {
var g = function f(i) {
return i === 0 ? 0 : f(i - 1) + 1;
};
havoc(g);
} else {
return;
}
return g(5);
});
```
1. Create a function expression that refers to itself inside a construct that wraps the evaluation in `evaluateForEffects()`. (I used an if-statement.)
2. Havoc the function expression. This will add the function’s reference to itself to `modifiedBindings`. However, the original [function expression skipped (3rd arg)](3eb1e8e8ea/src/evaluators/FunctionExpression.js (L108)) adding its binding to `modifiedBindings`.
3. Outside of `evaluateForEffects()` call the function.
4. Observe the invariant firing:
3eb1e8e8ea/src/environment.js (L339)
According to `modifiedBindings`, we only initialize the function expression _after_ its definition. So if the function expression wants to recursively refer to itself, it can’t since the effects we’ve recorded/applied puts us in a state where the binding is not available.
Pull Request resolved: https://github.com/facebook/prepack/pull/2443
Reviewed By: trueadm
Differential Revision: D9447861
Pulled By: calebmer
fbshipit-source-id: de4460bd184012416e80eb65f86dae7ade9dc34e
Summary:
`typeof React.forwardRef(...)` is `object` but Prepack was returning `function`. This is particularly important since React Native’s `Animated.createAnimatedComponent` crashes with an invariant if `typeof` is `function`. We can’t compile our React Native internal bundle without this fix.
22cf5dc566/Libraries/Animated/src/createAnimatedComponent.js (L20-L25)f9358c51c8/packages/react/src/forwardRef.js (L12-L43)
Small Prepack core change in `src/evaluators/UnaryExpression.js`.
Pull Request resolved: https://github.com/facebook/prepack/pull/2425
Reviewed By: trueadm
Differential Revision: D9447593
Pulled By: calebmer
fbshipit-source-id: de1e9101f368ea52c8c17c31d04a2e4e0a38dd6b
Summary:
Fixes#2437.
The code to handle for-statement bailouts was failing on nested for-in/for-out statements since while they had a variable declaration node in their AST the variable declaration behaves very differently. Notably there must be exactly one declaration, the declaration may not have an initializer, and the declaration may only be replaced by a `LeftHandSideExpression` not a expression or statement.
This PR does two things:
1. Replace the variable declarations in for-in/for-of statements with a `LeftHandSideExpression` which will then perform `DestructuringAssignment` with loop values in the evaluator.
2. Recognize that a `LeftHandSideExpression` in a for-in/for-of expression modifies bindings in the serializer residual function visitor.
Pull Request resolved: https://github.com/facebook/prepack/pull/2438
Reviewed By: trueadm
Differential Revision: D9446786
Pulled By: calebmer
fbshipit-source-id: e7f13a3c722602270a87cf8d933de1283b8121d1
Summary:
Fixes#2432.
`evaluateWithoutEffects` sets the realm generator to `undefined`. However, I found a case in #2432 where a generator is required in `evaluateWithoutEffects`.
What happens is that we build an error stack in `evaluateWithoutEffects`.
3eb1e8e8ea/src/realm.js (L1607-L1612)
As a part of building that error stack we try to get `EventEmitter.name`. However, `EventEmitter` is havoced! So we want to create an abstract temporal value `EventEmitter.name`. But creating a temporal value requires a generator since we need to add a generator entry.
3eb1e8e8ea/src/methods/properties.js (L1361-L1367)
This PR solves the issue by adding a throw-away generator to `evaluateWithoutEffects`. Other strategies might be a bit complicated since `evaluateWithoutEffects` is a very uncommon case. Removing `evaluateWithoutEffects` is also not a great option since in this case we would add a temporal `EventEmitter.name` when we never actually use it.
Pull Request resolved: https://github.com/facebook/prepack/pull/2436
Reviewed By: trueadm
Differential Revision: D9446792
Pulled By: calebmer
fbshipit-source-id: 14b36da1fb39dc9ab2a166ecb02d0f062b2bdffe
Summary:
This test bedeviled me for quite some time because I thought it was testing for aliasing effects - it isn't. This is my fault, since I posted this in my repro. Aliasing effects are still to be dealt with in nested optimized functions. Anyhow, simplifying to prevent somebody else from having this confusion.
Pull Request resolved: https://github.com/facebook/prepack/pull/2453
Reviewed By: trueadm
Differential Revision: D9420733
Pulled By: sb98052
fbshipit-source-id: 755ccd90b1e64afdfe6ec627a3306e8baf5952ea