Title: [207017] trunk
- Revision
- 207017
- Author
- [email protected]
- Date
- 2016-10-10 13:33:46 -0700 (Mon, 10 Oct 2016)
Log Message
compileCheckStringIdent in the FTL is wrong
https://bugs.webkit.org/show_bug.cgi?id=163215
Reviewed by Mark Lam and Filip Pizlo.
lowStringIdent() returns the StringImpl pointer. The compileCheckStringIdent()
was treating its return value as the actual JSString. This is wrong.
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCheckStringIdent):
Modified Paths
Added Paths
Diff
Added: trunk/JSTests/stress/check-string-ident.js (0 => 207017)
--- trunk/JSTests/stress/check-string-ident.js (rev 0)
+++ trunk/JSTests/stress/check-string-ident.js 2016-10-10 20:33:46 UTC (rev 207017)
@@ -0,0 +1,15 @@
+//@ defaultNoEagerRun
+
+const o = { baz: 20 };
+function foo(p) {
+ o[p] = 20;
+}
+noInline(foo);
+noOSRExitFuzzing(foo);
+
+for (let i = 0; i < 1000000; i++) {
+ foo("baz");
+}
+
+if (numberOfDFGCompiles(foo) > 1)
+ throw new Error("We should not have to compile this function more than once.");
Modified: trunk/Source/_javascript_Core/ChangeLog (207016 => 207017)
--- trunk/Source/_javascript_Core/ChangeLog 2016-10-10 20:21:30 UTC (rev 207016)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-10-10 20:33:46 UTC (rev 207017)
@@ -1,3 +1,16 @@
+2016-10-10 Saam Barati <[email protected]>
+
+ compileCheckStringIdent in the FTL is wrong
+ https://bugs.webkit.org/show_bug.cgi?id=163215
+
+ Reviewed by Mark Lam and Filip Pizlo.
+
+ lowStringIdent() returns the StringImpl pointer. The compileCheckStringIdent()
+ was treating its return value as the actual JSString. This is wrong.
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileCheckStringIdent):
+
2016-10-10 Yusuke Suzuki <[email protected]>
[DOMJIT] Implement Node accessors in DOMJIT
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (207016 => 207017)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2016-10-10 20:21:30 UTC (rev 207016)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2016-10-10 20:33:46 UTC (rev 207017)
@@ -2606,8 +2606,7 @@
void compileCheckStringIdent()
{
UniquedStringImpl* uid = m_node->uidOperand();
- LValue string = lowStringIdent(m_node->child1());
- LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
+ LValue stringImpl = lowStringIdent(m_node->child1());
speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
