[webkit-changes] [205944] trunk

Wed, 14 Sep 2016 18:14:43 -0700

Title: [205944] trunk
Revision
205944
Author
[email protected]
Date
2016-09-14 18:14:45 -0700 (Wed, 14 Sep 2016)

Log Message

ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
https://bugs.webkit.org/show_bug.cgi?id=162003

Patch by Joseph Pecoraro <[email protected]> on 2016-09-14
Reviewed by Saam Barati.

JSTests:

* stress/spread-calling.js:
* test262.yaml:

Source/_javascript_Core:

* bytecompiler/NodesCodegen.cpp:
(JSC::ArrayNode::isSimpleArray):
Don't treat an Array that has a spread _expression_ inside it as simple.
This avoids a fast path for f.apply(x, simpleArray) that was not handling
spread expressions within arrays, and instead taking a path that can
handle the spreading.

Modified Paths

Diff

Modified: trunk/JSTests/ChangeLog (205943 => 205944)


--- trunk/JSTests/ChangeLog	2016-09-15 01:08:20 UTC (rev 205943)
+++ trunk/JSTests/ChangeLog	2016-09-15 01:14:45 UTC (rev 205944)
@@ -1,3 +1,13 @@
+2016-09-14  Joseph Pecoraro  <[email protected]>
+
+        ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
+        https://bugs.webkit.org/show_bug.cgi?id=162003
+
+        Reviewed by Saam Barati.
+
+        * stress/spread-calling.js:
+        * test262.yaml:
+
 2016-09-14  Michael Saboff  <[email protected]>
 
         YARR doesn't check for invalid flags for literal regular expressions

Modified: trunk/JSTests/stress/spread-calling.js (205943 => 205944)


--- trunk/JSTests/stress/spread-calling.js	2016-09-15 01:08:20 UTC (rev 205943)
+++ trunk/JSTests/stress/spread-calling.js	2016-09-15 01:14:45 UTC (rev 205944)
@@ -68,6 +68,8 @@
     testFunction(0, ..."12345", ...object3);
     testEmpty(...[]);
     testFunction(...object4, ...object4);
+    testFunction.call(null, 0, ...[1, 2, 3], 4, 5, 6, 7, 8, 9);
+    testFunction.apply(null, [0, ...[1, 2, 3], 4, 5, 6, 7, 8, 9])
     let failed = false;
     try {
         testFunction(...objectThrow);

Modified: trunk/JSTests/test262.yaml (205943 => 205944)


--- trunk/JSTests/test262.yaml	2016-09-15 01:08:20 UTC (rev 205943)
+++ trunk/JSTests/test262.yaml	2016-09-15 01:14:45 UTC (rev 205944)
@@ -53236,21 +53236,21 @@
 - path: test262/test/language/expressions/array/spread-err-sngl-err-unresolvable.js
   cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
 - path: test262/test/language/expressions/array/spread-mult-empty.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
 - path: test262/test/language/expressions/array/spread-mult-empty.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
 - path: test262/test/language/expressions/array/spread-mult-expr.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
 - path: test262/test/language/expressions/array/spread-mult-expr.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
 - path: test262/test/language/expressions/array/spread-mult-iter.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
 - path: test262/test/language/expressions/array/spread-mult-iter.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
 - path: test262/test/language/expressions/array/spread-mult-literal.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
 - path: test262/test/language/expressions/array/spread-mult-literal.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
 - path: test262/test/language/expressions/array/spread-sngl-empty.js
   cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
 - path: test262/test/language/expressions/array/spread-sngl-empty.js
@@ -53260,9 +53260,9 @@
 - path: test262/test/language/expressions/array/spread-sngl-expr.js
   cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
 - path: test262/test/language/expressions/array/spread-sngl-iter.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
 - path: test262/test/language/expressions/array/spread-sngl-iter.js
-  cmd: runTest262 :fail, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
+  cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], [:strict]
 - path: test262/test/language/expressions/array/spread-sngl-literal.js
   cmd: runTest262 :normal, "NoException", ["../../../../harness/assert.js", "../../../../harness/sta.js"], []
 - path: test262/test/language/expressions/array/spread-sngl-literal.js

Modified: trunk/Source/_javascript_Core/ChangeLog (205943 => 205944)


--- trunk/Source/_javascript_Core/ChangeLog	2016-09-15 01:08:20 UTC (rev 205943)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-09-15 01:14:45 UTC (rev 205944)
@@ -1,3 +1,17 @@
+2016-09-14  Joseph Pecoraro  <[email protected]>
+
+        ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
+        https://bugs.webkit.org/show_bug.cgi?id=162003
+
+        Reviewed by Saam Barati.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::isSimpleArray):
+        Don't treat an Array that has a spread _expression_ inside it as simple.
+        This avoids a fast path for f.apply(x, simpleArray) that was not handling
+        spread expressions within arrays, and instead taking a path that can
+        handle the spreading.
+
 2016-09-14  Commit Queue  <[email protected]>
 
         Unreviewed, rolling out r205933 and r205936.

Modified: trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp (205943 => 205944)


--- trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp	2016-09-15 01:08:20 UTC (rev 205943)
+++ trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp	2016-09-15 01:14:45 UTC (rev 205944)
@@ -413,6 +413,8 @@
     for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
         if (ptr->elision())
             return false;
+        if (ptr->value()->isSpreadExpression())
+            return false;
     }
     return true;
 }

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to