- Revision
- 237325
- Author
- [email protected]
- Date
- 2018-10-22 10:18:13 -0700 (Mon, 22 Oct 2018)
Log Message
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
Reviewed by Saam Barati.
JSTests:
* stress/regress-190515.js: Added.
Source/_javascript_Core:
1. Fixes calls to asArrayModes() to take a structure's IndexingMode instead of
IndexingType.
2. DFG's compileNewArrayBuffer()'s HaveABadTime case was previously using the
node's indexingType (instead of indexingMode) to choose the array structure
to use for creating an array buffer with. This turns out to not be an issue
because when the VM is in having a bad time, all the
arrayStructureForIndexingTypeDuringAllocation structure pointers will point to
the SlowPutArrayStorage structure anyway. However, to be strictly correct,
we'll fix it to use the structure for the node's indexingMode.
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::mergeOSREntryValue):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::validate const):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::executeOSRExit):
* dfg/DFGRegisteredStructureSet.cpp:
(JSC::DFG::RegisteredStructureSet::arrayModesFromStructures const):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewArrayBuffer):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (237324 => 237325)
--- trunk/JSTests/ChangeLog 2018-10-22 16:27:32 UTC (rev 237324)
+++ trunk/JSTests/ChangeLog 2018-10-22 17:18:13 UTC (rev 237325)
@@ -1,3 +1,13 @@
+2018-10-22 Mark Lam <[email protected]>
+
+ DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
+ https://bugs.webkit.org/show_bug.cgi?id=190515
+ <rdar://problem/45222379>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-190515.js: Added.
+
2018-10-19 Commit Queue <[email protected]>
Unreviewed, rolling out r237254.
Added: trunk/JSTests/stress/regress-190515.js (0 => 237325)
--- trunk/JSTests/stress/regress-190515.js (rev 0)
+++ trunk/JSTests/stress/regress-190515.js 2018-10-22 17:18:13 UTC (rev 237325)
@@ -0,0 +1,26 @@
+function set(arr, value) {
+ arr[0] = value;
+}
+
+function getImmutableArrayOrSet(get) {
+ let arr = [1];
+ if (get)
+ return arr;
+
+ set(arr, 42);
+ set({}, 1);
+}
+noInline(getImmutableArrayOrSet);
+
+function test() {
+ getImmutableArrayOrSet(true);
+
+ for (let i = 0; i < 10000; i++)
+ getImmutableArrayOrSet(false);
+
+ let arr = getImmutableArrayOrSet(true);
+ if (arr[0] != 1)
+ throw "FAILED";
+}
+
+test();
Modified: trunk/Source/_javascript_Core/ChangeLog (237324 => 237325)
--- trunk/Source/_javascript_Core/ChangeLog 2018-10-22 16:27:32 UTC (rev 237324)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-10-22 17:18:13 UTC (rev 237325)
@@ -1,3 +1,34 @@
+2018-10-22 Mark Lam <[email protected]>
+
+ DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
+ https://bugs.webkit.org/show_bug.cgi?id=190515
+ <rdar://problem/45222379>
+
+ Reviewed by Saam Barati.
+
+ 1. Fixes calls to asArrayModes() to take a structure's IndexingMode instead of
+ IndexingType.
+
+ 2. DFG's compileNewArrayBuffer()'s HaveABadTime case was previously using the
+ node's indexingType (instead of indexingMode) to choose the array structure
+ to use for creating an array buffer with. This turns out to not be an issue
+ because when the VM is in having a bad time, all the
+ arrayStructureForIndexingTypeDuringAllocation structure pointers will point to
+ the SlowPutArrayStorage structure anyway. However, to be strictly correct,
+ we'll fix it to use the structure for the node's indexingMode.
+
+ * dfg/DFGAbstractValue.cpp:
+ (JSC::DFG::AbstractValue::set):
+ (JSC::DFG::AbstractValue::mergeOSREntryValue):
+ * dfg/DFGAbstractValue.h:
+ (JSC::DFG::AbstractValue::validate const):
+ * dfg/DFGOSRExit.cpp:
+ (JSC::DFG::OSRExit::executeOSRExit):
+ * dfg/DFGRegisteredStructureSet.cpp:
+ (JSC::DFG::RegisteredStructureSet::arrayModesFromStructures const):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileNewArrayBuffer):
+
2018-10-19 Commit Queue <[email protected]>
Unreviewed, rolling out r237254.
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractValue.cpp (237324 => 237325)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractValue.cpp 2018-10-22 16:27:32 UTC (rev 237324)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractValue.cpp 2018-10-22 17:18:13 UTC (rev 237325)
@@ -60,7 +60,7 @@
m_arrayModes = ALL_ARRAY_MODES;
m_structure.clobber();
} else
- m_arrayModes = asArrayModes(structure->indexingType());
+ m_arrayModes = asArrayModes(structure->indexingMode());
} else {
m_structure.makeTop();
m_arrayModes = ALL_ARRAY_MODES;
@@ -87,7 +87,7 @@
RELEASE_ASSERT(structure);
m_structure = structure;
- m_arrayModes = asArrayModes(structure->indexingType());
+ m_arrayModes = asArrayModes(structure->indexingMode());
m_type = speculationFromStructure(structure.get());
m_value = JSValue();
@@ -228,7 +228,7 @@
FrozenValue* frozenValue = graph.freeze(value);
if (frozenValue->pointsToHeap()) {
m_structure = graph.registerStructure(frozenValue->structure());
- m_arrayModes = asArrayModes(frozenValue->structure()->indexingType());
+ m_arrayModes = asArrayModes(frozenValue->structure()->indexingMode());
} else {
m_structure.clear();
m_arrayModes = 0;
@@ -240,7 +240,7 @@
mergeSpeculation(m_type, speculationFromValue(value));
if (!!value && value.isCell()) {
RegisteredStructure structure = graph.registerStructure(value.asCell()->structure(graph.m_vm));
- mergeArrayModes(m_arrayModes, asArrayModes(structure->indexingType()));
+ mergeArrayModes(m_arrayModes, asArrayModes(structure->indexingMode()));
m_structure.merge(RegisteredStructureSet(structure));
}
if (m_value != value)
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h (237324 => 237325)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h 2018-10-22 16:27:32 UTC (rev 237324)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h 2018-10-22 17:18:13 UTC (rev 237325)
@@ -397,7 +397,7 @@
ASSERT(m_type & SpecCell);
Structure* structure = value.asCell()->structure();
return m_structure.contains(structure)
- && (m_arrayModes & asArrayModes(structure->indexingType()));
+ && (m_arrayModes & asArrayModes(structure->indexingMode()));
}
return true;
Modified: trunk/Source/_javascript_Core/dfg/DFGOSRExit.cpp (237324 => 237325)
--- trunk/Source/_javascript_Core/dfg/DFGOSRExit.cpp 2018-10-22 16:27:32 UTC (rev 237324)
+++ trunk/Source/_javascript_Core/dfg/DFGOSRExit.cpp 2018-10-22 17:18:13 UTC (rev 237325)
@@ -499,7 +499,7 @@
ASSERT(exit.m_kind == BadCache || exit.m_kind == BadIndexingType);
Structure* structure = profiledValue.asCell()->structure(vm);
arrayProfile->observeStructure(structure);
- arrayProfile->observeArrayMode(asArrayModes(structure->indexingType()));
+ arrayProfile->observeArrayMode(asArrayModes(structure->indexingMode()));
}
if (extraInitializationLevel <= ExtraInitializationLevel::ArrayProfileUpdate)
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGRegisteredStructureSet.cpp (237324 => 237325)
--- trunk/Source/_javascript_Core/dfg/DFGRegisteredStructureSet.cpp 2018-10-22 16:27:32 UTC (rev 237324)
+++ trunk/Source/_javascript_Core/dfg/DFGRegisteredStructureSet.cpp 2018-10-22 17:18:13 UTC (rev 237325)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2018 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -79,7 +79,7 @@
ArrayModes result = 0;
forEach(
[&] (RegisteredStructure structure) {
- mergeArrayModes(result, asArrayModes(structure->indexingType()));
+ mergeArrayModes(result, asArrayModes(structure->indexingMode()));
});
return result;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (237324 => 237325)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2018-10-22 16:27:32 UTC (rev 237324)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2018-10-22 17:18:13 UTC (rev 237325)
@@ -12175,7 +12175,7 @@
flushRegisters();
GPRFlushedCallResult result(this);
- callOperation(operationNewArrayBuffer, result.gpr(), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())), TrustedImmPtr(node->cellOperand()));
+ callOperation(operationNewArrayBuffer, result.gpr(), structure, TrustedImmPtr(node->cellOperand()));
m_jit.exceptionCheck();
cellResult(result.gpr(), node);
