Title: [244314] trunk
- Revision
- 244314
- Author
- [email protected]
- Date
- 2019-04-15 17:39:26 -0700 (Mon, 15 Apr 2019)
Log Message
SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
https://bugs.webkit.org/show_bug.cgi?id=196945
<rdar://problem/49802750>
Reviewed by Filip Pizlo.
JSTests:
* stress/get-by-offset-should-use-correct-child.js: Added.
(foo.bar):
(foo):
Source/_javascript_Core:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (244313 => 244314)
--- trunk/JSTests/ChangeLog 2019-04-16 00:28:47 UTC (rev 244313)
+++ trunk/JSTests/ChangeLog 2019-04-16 00:39:26 UTC (rev 244314)
@@ -1,3 +1,15 @@
+2019-04-15 Saam barati <[email protected]>
+
+ SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+ https://bugs.webkit.org/show_bug.cgi?id=196945
+ <rdar://problem/49802750>
+
+ Reviewed by Filip Pizlo.
+
+ * stress/get-by-offset-should-use-correct-child.js: Added.
+ (foo.bar):
+ (foo):
+
2019-04-15 Robin Morisset <[email protected]>
DFG should be able to constant fold Object.create() with a constant prototype operand
Added: trunk/JSTests/stress/get-by-offset-should-use-correct-child.js (0 => 244314)
--- trunk/JSTests/stress/get-by-offset-should-use-correct-child.js (rev 0)
+++ trunk/JSTests/stress/get-by-offset-should-use-correct-child.js 2019-04-16 00:39:26 UTC (rev 244314)
@@ -0,0 +1,25 @@
+function foo(x) {
+ for (let i = 0; i < 400; i++) {
+ for (let j = 0; j < 2; j++) {
+ for (const k of arguments) {
+ }
+ arguments.length = 0;
+ const q = {
+ z: 0
+ };
+ function bar() {
+ q;
+ }
+ for (let w = 0; w < 300; w++) {
+ }
+ }
+
+ with ({}) {
+ }
+
+ +{};
+ }
+}
+
+foo(0);
+foo(0);
Modified: trunk/Source/_javascript_Core/ChangeLog (244313 => 244314)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-16 00:28:47 UTC (rev 244313)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-16 00:39:26 UTC (rev 244314)
@@ -1,3 +1,14 @@
+2019-04-15 Saam barati <[email protected]>
+
+ SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+ https://bugs.webkit.org/show_bug.cgi?id=196945
+ <rdar://problem/49802750>
+
+ Reviewed by Filip Pizlo.
+
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+
2019-04-15 Robin Morisset <[email protected]>
DFG should be able to constant fold Object.create() with a constant prototype operand
Modified: trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h (244313 => 244314)
--- trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2019-04-16 00:28:47 UTC (rev 244313)
+++ trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2019-04-16 00:39:26 UTC (rev 244314)
@@ -545,13 +545,13 @@
// know anything about inferred types. But if we have a proof derived from watching a
// structure that has a type proof, then the next case below will deal with it.
if (state.structureClobberState() == StructuresAreWatched) {
- if (JSObject* knownBase = node->child1()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
+ if (JSObject* knownBase = node->child2()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
if (graph.isSafeToLoad(knownBase, offset))
return true;
}
}
- StructureAbstractValue& value = state.forNode(node->child1()).m_structure;
+ StructureAbstractValue& value = state.forNode(node->child2()).m_structure;
if (value.isInfinite())
return false;
for (unsigned i = value.size(); i--;) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
