Title: [238923] trunk
- Revision
- 238923
- Author
- [email protected]
- Date
- 2018-12-05 20:34:27 -0800 (Wed, 05 Dec 2018)
Log Message
speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
https://bugs.webkit.org/show_bug.cgi?id=192441
<rdar://problem/46480355>
Reviewed by Saam Barati.
JSTests:
* stress/regress-192441.js: Added.
Source/_javascript_Core:
This is because a regular String (non-Identifier) can be converted into an
Identifier. During DFG/FTL compilation, AbstractValue::checkConsistency() may
expect a value to be of type SpecStringVar, but the mutator thread may have
converted the string into an Identifier. This creates a race where
AbstractValue::checkConsistency() may fail because it sees a SpecStringIdent when
it expects the a SpecStringVar.
The fix is to speculate non-Identifier strings as type SpecString which allows it
to be SpecStringVar or SpecStringIndent.
* bytecode/SpeculatedType.cpp:
(JSC::speculationFromCell):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (238922 => 238923)
--- trunk/JSTests/ChangeLog 2018-12-06 03:46:37 UTC (rev 238922)
+++ trunk/JSTests/ChangeLog 2018-12-06 04:34:27 UTC (rev 238923)
@@ -1,3 +1,13 @@
+2018-12-05 Mark Lam <[email protected]>
+
+ speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
+ https://bugs.webkit.org/show_bug.cgi?id=192441
+ <rdar://problem/46480355>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-192441.js: Added.
+
2018-12-04 Mark Lam <[email protected]>
DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
Added: trunk/JSTests/stress/regress-192441.js (0 => 238923)
--- trunk/JSTests/stress/regress-192441.js (rev 0)
+++ trunk/JSTests/stress/regress-192441.js 2018-12-06 04:34:27 UTC (rev 238923)
@@ -0,0 +1,12 @@
+//@ requireOptions("--jitPolicyScale=0")
+
+// This test passes if it does not crash.
+
+let x = {}
+let enUS = ['en', 'US'].join('-')
+for (let i=0; i<100; i++) {
+ Intl.NumberFormat(enUS)
+}
+for (let i=0; i<10000; i++) {
+ x[enUS]
+};
Modified: trunk/Source/_javascript_Core/ChangeLog (238922 => 238923)
--- trunk/Source/_javascript_Core/ChangeLog 2018-12-06 03:46:37 UTC (rev 238922)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-12-06 04:34:27 UTC (rev 238923)
@@ -1,3 +1,24 @@
+2018-12-05 Mark Lam <[email protected]>
+
+ speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
+ https://bugs.webkit.org/show_bug.cgi?id=192441
+ <rdar://problem/46480355>
+
+ Reviewed by Saam Barati.
+
+ This is because a regular String (non-Identifier) can be converted into an
+ Identifier. During DFG/FTL compilation, AbstractValue::checkConsistency() may
+ expect a value to be of type SpecStringVar, but the mutator thread may have
+ converted the string into an Identifier. This creates a race where
+ AbstractValue::checkConsistency() may fail because it sees a SpecStringIdent when
+ it expects the a SpecStringVar.
+
+ The fix is to speculate non-Identifier strings as type SpecString which allows it
+ to be SpecStringVar or SpecStringIndent.
+
+ * bytecode/SpeculatedType.cpp:
+ (JSC::speculationFromCell):
+
2018-12-04 Mark Lam <[email protected]>
DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
Modified: trunk/Source/_javascript_Core/bytecode/SpeculatedType.cpp (238922 => 238923)
--- trunk/Source/_javascript_Core/bytecode/SpeculatedType.cpp 2018-12-06 03:46:37 UTC (rev 238922)
+++ trunk/Source/_javascript_Core/bytecode/SpeculatedType.cpp 2018-12-06 04:34:27 UTC (rev 238923)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -480,7 +480,7 @@
if (impl->isAtomic())
return SpecStringIdent;
}
- return SpecStringVar;
+ return SpecString;
}
return speculationFromStructure(cell->structure());
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
