[webkit-changes] [206573] trunk

Wed, 28 Sep 2016 18:28:44 -0700

Title: [206573] trunk
Revision
206573
Author
[email protected]
Date
2016-09-28 18:29:03 -0700 (Wed, 28 Sep 2016)

Log Message

stringProtoFuncRepeatCharacter will return `null` when it should not
https://bugs.webkit.org/show_bug.cgi?id=161944

Reviewed by Yusuke Suzuki.

JSTests:

* stress/pad-start-calls-repeat-character-with-double.js: Added.
(logLinesWithContext):

Source/_javascript_Core:

stringProtoFuncRepeatCharacter was expecting its second argument
to always be a boxed integer. This is not correct. The DFG may decide
to represent a particular value as a double instead of integer. This
function needs to have correct behavior when its second argument is
a boxed double. I also added an assertion stating that the second argument
is always a number. We can guarantee this since it's only called from
builtins.

* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncRepeatCharacter):

Modified Paths

Added Paths

Diff

Modified: trunk/JSTests/ChangeLog (206572 => 206573)


--- trunk/JSTests/ChangeLog	2016-09-29 01:14:38 UTC (rev 206572)
+++ trunk/JSTests/ChangeLog	2016-09-29 01:29:03 UTC (rev 206573)
@@ -1,3 +1,13 @@
+2016-09-28  Saam Barati  <[email protected]>
+
+        stringProtoFuncRepeatCharacter will return `null` when it should not
+        https://bugs.webkit.org/show_bug.cgi?id=161944
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/pad-start-calls-repeat-character-with-double.js: Added.
+        (logLinesWithContext):
+
 2016-09-27  Filip Pizlo  <[email protected]>
 
         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64

Added: trunk/JSTests/stress/pad-start-calls-repeat-character-with-double.js (0 => 206573)


--- trunk/JSTests/stress/pad-start-calls-repeat-character-with-double.js	                        (rev 0)
+++ trunk/JSTests/stress/pad-start-calls-repeat-character-with-double.js	2016-09-29 01:29:03 UTC (rev 206573)
@@ -0,0 +1,43 @@
+function logLinesWithContext(n, context) {
+    let start = n - context;
+    let end = n + context;
+    for (let x = start; x <= end; ++x) {
+        let number = x.toString().padStart(3);
+        if (parseInt(number) !== x)
+            throw new Error("Bad result from pad start: " + number);
+    }
+}
+noInline(logLinesWithContext);
+
+let numbers = [
+    19,19,19,19,19,19,19,20,20,20,20,20,20,20,11,11,11,11,11,11,11,20,20,20,20,
+    20,20,20,15,15,15,15,15,15,15,21,21,21,21,21,21,21,19,19,19,19,19,19,19,20,
+    20,20,20,20,20,20,20,20,20,20,20,20,20,21,21,21,21,21,21,21,24,24,24,24,24,
+    24,24,25,25,25,25,25,25,25,11,11,11,11,11,11,11,25,25,25,25,25,25,25,15,15,
+    15,15,15,15,15,25,25,25,25,25,25,25,7,7,7,7,7,7,7,26,26,26,26,26,26,26,24,
+    24,24,24,24,24,24,25,25,25,25,25,25,25,11,11,11,11,11,11,11,25,25,25,25,25,
+    25,25,26,26,26,26,26,26,26,24,24,24,24,24,24,24,25,25,25,25,25,25,25,11,11,
+    11,11,11,11,11,12,12,12,12,12,12,12,25,25,25,25,25,25,25,15,15,15,15,15,15,
+    15,16,16,16,16,16,16,16,25,25,25,25,25,25,25,7,7,7,7,7,7,7,8,8,8,8,8,8,8,
+    26,26,26,26,26,26,26,24,24,24,24,24,24,24,25,25,25,25,25,25,25,11,11,11,11,
+    11,11,11,12,12,12,12,12,12,12,25,25,25,25,25,25,25,15,15,15,15,15,15,15,16,
+    16,16,16,16,16,16,25,25,25,25,25,25,25,7,7,7,7,7,7,7,8,8,8,8,8,8,8,26,26,
+    26,26,26,26,26,29,29,29,29,29,29,29,30,30,30,30,30,30,30,35,35,35,35,35,35,
+    35,29,29,29,29,29,29,29,30,30,30,30,30,30,30,11,11,11,11,11,11,11,33,33,33,
+    33,33,33,33,35,35,35,35,35,35,35,39,39,39,39,39,39,39,40,40,40,40,40,40,40,
+    11,11,11,11,11,11,11,40,40,40,40,40,40,40,40,40,40,40,40,40,40,15,15,15,15,
+    15,15,15,41,41,41,41,41,41,41,39,39,39,39,39,39,39,40,40,40,40,40,40,40,40,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+    45,45,46,46,46,46,46,46,46,11,11,11,11,11,11,11,46,46,46,46,46,46,46,15,15,
+];
+
+for (let n of numbers)
+    logLinesWithContext(n, 3);

Modified: trunk/Source/_javascript_Core/ChangeLog (206572 => 206573)


--- trunk/Source/_javascript_Core/ChangeLog	2016-09-29 01:14:38 UTC (rev 206572)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-09-29 01:29:03 UTC (rev 206573)
@@ -1,3 +1,21 @@
+2016-09-28  Saam Barati  <[email protected]>
+
+        stringProtoFuncRepeatCharacter will return `null` when it should not
+        https://bugs.webkit.org/show_bug.cgi?id=161944
+
+        Reviewed by Yusuke Suzuki.
+
+        stringProtoFuncRepeatCharacter was expecting its second argument
+        to always be a boxed integer. This is not correct. The DFG may decide
+        to represent a particular value as a double instead of integer. This
+        function needs to have correct behavior when its second argument is
+        a boxed double. I also added an assertion stating that the second argument
+        is always a number. We can guarantee this since it's only called from
+        builtins.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncRepeatCharacter):
+
 2016-09-28  Filip Pizlo  <[email protected]>
 
         The write barrier should be down with TSO

Modified: trunk/Source/_javascript_Core/builtins/StringPrototype.js (206572 => 206573)


--- trunk/Source/_javascript_Core/builtins/StringPrototype.js	2016-09-29 01:14:38 UTC (rev 206572)
+++ trunk/Source/_javascript_Core/builtins/StringPrototype.js	2016-09-29 01:29:03 UTC (rev 206573)
@@ -110,11 +110,8 @@
     if (count < 0 || count === @Infinity)
         throw new @RangeError("String.prototype.repeat argument must be greater than or equal to 0 and not be Infinity");
 
-    if (string.length === 1) {
-        var result = @repeatCharacter(string, count);
-        if (result !== null)
-            return result;
-    }
+    if (string.length === 1)
+        return @repeatCharacter(string, count);
 
     return @repeatSlowPath(string, count);
 }

Modified: trunk/Source/_javascript_Core/runtime/StringPrototype.cpp (206572 => 206573)


--- trunk/Source/_javascript_Core/runtime/StringPrototype.cpp	2016-09-29 01:14:38 UTC (rev 206572)
+++ trunk/Source/_javascript_Core/runtime/StringPrototype.cpp	2016-09-29 01:29:03 UTC (rev 206573)
@@ -780,11 +780,19 @@
     JSString* string = jsCast<JSString*>(exec->uncheckedArgument(0));
     ASSERT(string->length() == 1);
 
-    if (!exec->uncheckedArgument(1).isInt32())
-        return JSValue::encode(jsNull());
-
-    int32_t repeatCount = exec->uncheckedArgument(1).asInt32();
+    JSValue repeatCountValue = exec->uncheckedArgument(1);
+    RELEASE_ASSERT(repeatCountValue.isNumber());
+    int32_t repeatCount;
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        double value = repeatCountValue.asNumber();
+        if (value > JSString::MaxLength)
+            return JSValue::encode(throwOutOfMemoryError(exec, scope));
+        repeatCount = static_cast<int32_t>(value);
+    }
     ASSERT(repeatCount >= 0);
+    ASSERT(!repeatCountValue.isDouble() || repeatCountValue.asDouble() == repeatCount);
 
     UChar character = string->view(exec)[0];
     if (!(character & ~0xff))

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to