Title: [238510] trunk
- Revision
- 238510
- Author
- [email protected]
- Date
- 2018-11-26 12:14:41 -0800 (Mon, 26 Nov 2018)
Log Message
Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
https://bugs.webkit.org/show_bug.cgi?id=191958
<rdar://problem/46221877>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
(x):
(foo):
Source/_javascript_Core:
There may be more entries in an activation than unique variables
in a symbol table's hashmap. For example, if you have two parameters
to a function, and they both are the same name, and the function
uses eval, we'll end up with two scope slots, but only a single
entry in the hashmap in the symbol table. Object allocation sinking
phase was previously iterating over the hashmap, assuming these
values were equivalent. This is wrong in the above case. Instead,
we need to iterate over each scope offset.
* dfg/DFGObjectAllocationSinkingPhase.cpp:
* runtime/GenericOffset.h:
(JSC::GenericOffset::operator+=):
(JSC::GenericOffset::operator-=):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (238509 => 238510)
--- trunk/JSTests/ChangeLog 2018-11-26 20:06:30 UTC (rev 238509)
+++ trunk/JSTests/ChangeLog 2018-11-26 20:14:41 UTC (rev 238510)
@@ -1,3 +1,15 @@
+2018-11-26 Saam barati <[email protected]>
+
+ Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
+ https://bugs.webkit.org/show_bug.cgi?id=191958
+ <rdar://problem/46221877>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
+ (x):
+ (foo):
+
2018-11-26 Mark Lam <[email protected]>
NaNs read from Wasm code needs to be be purified.
Added: trunk/JSTests/stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js (0 => 238510)
--- trunk/JSTests/stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js (rev 0)
+++ trunk/JSTests/stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js 2018-11-26 20:14:41 UTC (rev 238510)
@@ -0,0 +1,13 @@
+//@ runDefault("--forceEagerCompilation=1", "--useConcurrentJIT=0")
+
+function foo(a, a) {
+ function x() {
+ eval();
+ }
+}
+foo();
+foo();
+foo();
+foo();
+foo();
+foo(0);
Modified: trunk/Source/_javascript_Core/ChangeLog (238509 => 238510)
--- trunk/Source/_javascript_Core/ChangeLog 2018-11-26 20:06:30 UTC (rev 238509)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-11-26 20:14:41 UTC (rev 238510)
@@ -1,3 +1,25 @@
+2018-11-26 Saam barati <[email protected]>
+
+ Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
+ https://bugs.webkit.org/show_bug.cgi?id=191958
+ <rdar://problem/46221877>
+
+ Reviewed by Yusuke Suzuki.
+
+ There may be more entries in an activation than unique variables
+ in a symbol table's hashmap. For example, if you have two parameters
+ to a function, and they both are the same name, and the function
+ uses eval, we'll end up with two scope slots, but only a single
+ entry in the hashmap in the symbol table. Object allocation sinking
+ phase was previously iterating over the hashmap, assuming these
+ values were equivalent. This is wrong in the above case. Instead,
+ we need to iterate over each scope offset.
+
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+ * runtime/GenericOffset.h:
+ (JSC::GenericOffset::operator+=):
+ (JSC::GenericOffset::operator-=):
+
2018-11-26 Mark Lam <[email protected]>
NaNs read from Wasm code needs to be be purified.
Modified: trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp (238509 => 238510)
--- trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2018-11-26 20:06:30 UTC (rev 238509)
+++ trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2018-11-26 20:14:41 UTC (rev 238510)
@@ -877,11 +877,10 @@
writes.add(ActivationScopePLoc, LazyNode(node->child1().node()));
{
SymbolTable* symbolTable = node->castOperand<SymbolTable*>();
- ConcurrentJSLocker locker(symbolTable->m_lock);
LazyNode initialValue(m_graph.freeze(node->initializationValueForActivation()));
- for (auto iter = symbolTable->begin(locker), end = symbolTable->end(locker); iter != end; ++iter) {
+ for (ScopeOffset offset { 0 }; offset <= symbolTable->maxScopeOffset(); offset += 1) {
writes.add(
- PromotedLocationDescriptor(ClosureVarPLoc, iter->value.scopeOffset().offset()),
+ PromotedLocationDescriptor(ClosureVarPLoc, offset.offset()),
initialValue);
}
}
Modified: trunk/Source/_javascript_Core/runtime/GenericOffset.h (238509 => 238510)
--- trunk/Source/_javascript_Core/runtime/GenericOffset.h 2018-11-26 20:06:30 UTC (rev 238509)
+++ trunk/Source/_javascript_Core/runtime/GenericOffset.h 2018-11-26 20:14:41 UTC (rev 238510)
@@ -95,11 +95,11 @@
}
T& operator+=(int value)
{
- return *this = *this + value;
+ return *static_cast<T*>(this) = *this + value;
}
T& operator-=(int value)
{
- return *this = *this - value;
+ return *static_cast<T*>(this) = *this - value;
}
private:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
