Title: [245203] trunk
- Revision
- 245203
- Author
- [email protected]
- Date
- 2019-05-10 18:40:00 -0700 (Fri, 10 May 2019)
Log Message
Call to JSToWasmICCallee::createStructure passes in wrong prototype value
https://bugs.webkit.org/show_bug.cgi?id=197807
<rdar://problem/50530400>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/js-to-wasm-callee-has-correct-prototype.js: Added.
(test.getInstance):
(test):
Source/_javascript_Core:
We were passing the empty value instead of null. However, the empty
value means the Structure is poly proto. That's definitely not the case
here.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (245202 => 245203)
--- trunk/JSTests/ChangeLog 2019-05-11 00:39:58 UTC (rev 245202)
+++ trunk/JSTests/ChangeLog 2019-05-11 01:40:00 UTC (rev 245203)
@@ -1,3 +1,15 @@
+2019-05-10 Saam barati <[email protected]>
+
+ Call to JSToWasmICCallee::createStructure passes in wrong prototype value
+ https://bugs.webkit.org/show_bug.cgi?id=197807
+ <rdar://problem/50530400>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/js-to-wasm-callee-has-correct-prototype.js: Added.
+ (test.getInstance):
+ (test):
+
2019-05-10 Ross Kirsling <[email protected]>
[Test262] Unreviewed expectations update following r245188.
Added: trunk/JSTests/stress/js-to-wasm-callee-has-correct-prototype.js (0 => 245203)
--- trunk/JSTests/stress/js-to-wasm-callee-has-correct-prototype.js (rev 0)
+++ trunk/JSTests/stress/js-to-wasm-callee-has-correct-prototype.js 2019-05-11 01:40:00 UTC (rev 245203)
@@ -0,0 +1,22 @@
+//@ runDefault("--jitPolicyScale=0", "--useSamplingProfiler=1")
+
+function test() {
+ function getInstance(bytes) {
+ let u8 = Uint8Array.from(bytes, x=>x.charCodeAt(0));
+ let module = new WebAssembly.Module(u8.buffer);
+ return new WebAssembly.Instance(module);
+ }
+
+ let webAsm = getInstance('\0asm\x01\0\0\0\x01\x8E\x80\x80\x80\0\x03`\0\x01\x7F`\0\x01\x7F`\x01\x7F\x01\x7F\x03\x88\x80\x80\x80\0\x07\0\0\0\x01\x01\x02\x02\x04\x85\x80\x80\x80\0\x01p\x01\x07\x07\x07\x91\x80\x80\x80\0\x02\x05callt\0\x05\x05callu\0\x06\t\x8D\x80\x80\x80\0\x01\0A\0\x0B\x07\0\x01\x02\x03\x04\0\x02\nÆ\x80\x80\x80\0\x07\x84\x80\x80\x80\0\0A\x01\x0B\x84\x80\x80\x80\0\0A\x02\x0B\x84\x80\x80\x80\0\0A\x03\x0B\x84\x80\x80\x80\0\0A\x04\x0B\x84\x80\x80\x80\0\0A\x05\x0B\x87\x80\x80\x80\0\0 \0\x11\0\0\x0B\x87\x80\x80\x80\0\0 \0\x11\x01\0\x0B');
+
+ for (let j = 0; j < 1000; j++) {
+ try {
+ webAsm.exports.callt(-1);
+ } catch(e) {}
+ }
+
+ samplingProfilerStackTraces();
+}
+
+if (this.WebAssembly)
+ test();
Modified: trunk/Source/_javascript_Core/ChangeLog (245202 => 245203)
--- trunk/Source/_javascript_Core/ChangeLog 2019-05-11 00:39:58 UTC (rev 245202)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-05-11 01:40:00 UTC (rev 245203)
@@ -1,3 +1,18 @@
+2019-05-10 Saam barati <[email protected]>
+
+ Call to JSToWasmICCallee::createStructure passes in wrong prototype value
+ https://bugs.webkit.org/show_bug.cgi?id=197807
+ <rdar://problem/50530400>
+
+ Reviewed by Yusuke Suzuki.
+
+ We were passing the empty value instead of null. However, the empty
+ value means the Structure is poly proto. That's definitely not the case
+ here.
+
+ * runtime/JSGlobalObject.cpp:
+ (JSC::JSGlobalObject::init):
+
2019-05-10 Yusuke Suzuki <[email protected]>
[JSC] String substring operation should return ropes consistently
Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp (245202 => 245203)
--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp 2019-05-11 00:39:58 UTC (rev 245202)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp 2019-05-11 01:40:00 UTC (rev 245203)
@@ -1062,7 +1062,7 @@
});
m_jsToWasmICCalleeStructure.initLater(
[] (const Initializer<Structure>& init) {
- init.set(JSToWasmICCallee::createStructure(init.vm, init.owner, JSValue()));
+ init.set(JSToWasmICCallee::createStructure(init.vm, init.owner, jsNull()));
});
m_webAssemblyWrapperFunctionStructure.initLater(
[] (const Initializer<Structure>& init) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
