Title: [246379] branches/safari-607-branch
- Revision
- 246379
- Author
- [email protected]
- Date
- 2019-06-12 15:20:54 -0700 (Wed, 12 Jun 2019)
Log Message
Cherry-pick r246071. rdar://problem/51656838
Argument elimination should check for negative indices in GetByVal
https://bugs.webkit.org/show_bug.cgi?id=198302
<rdar://problem/51188095>
Reviewed by Filip Pizlo.
JSTests:
* stress/eliminate-arguments-negative-rest-access.js: Added.
(inlinee):
(opt):
Source/_javascript_Core:
In DFG::ArgumentEliminationPhase, the index is treated as unsigned, but there's no check
for overflow in the addition. In compileGetMyArgumentByVal, there's a check for overflow,
but the index is treated as signed, resulting in an index lower than numberOfArgumentsToSkip.
* dfg/DFGArgumentsEliminationPhase.cpp:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246071 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/JSTests/ChangeLog (246378 => 246379)
--- branches/safari-607-branch/JSTests/ChangeLog 2019-06-12 22:20:51 UTC (rev 246378)
+++ branches/safari-607-branch/JSTests/ChangeLog 2019-06-12 22:20:54 UTC (rev 246379)
@@ -1,3 +1,43 @@
+2019-06-12 Null <[email protected]>
+
+ Cherry-pick r246071. rdar://problem/51656838
+
+ Argument elimination should check for negative indices in GetByVal
+ https://bugs.webkit.org/show_bug.cgi?id=198302
+ <rdar://problem/51188095>
+
+ Reviewed by Filip Pizlo.
+
+ JSTests:
+
+ * stress/eliminate-arguments-negative-rest-access.js: Added.
+ (inlinee):
+ (opt):
+
+ Source/_javascript_Core:
+
+ In DFG::ArgumentEliminationPhase, the index is treated as unsigned, but there's no check
+ for overflow in the addition. In compileGetMyArgumentByVal, there's a check for overflow,
+ but the index is treated as signed, resulting in an index lower than numberOfArgumentsToSkip.
+
+ * dfg/DFGArgumentsEliminationPhase.cpp:
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246071 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-06-04 Tadeu Zagallo <[email protected]>
+
+ Argument elimination should check for negative indices in GetByVal
+ https://bugs.webkit.org/show_bug.cgi?id=198302
+ <rdar://problem/51188095>
+
+ Reviewed by Filip Pizlo.
+
+ * stress/eliminate-arguments-negative-rest-access.js: Added.
+ (inlinee):
+ (opt):
+
2019-05-30 Kocsen Chung <[email protected]>
Cherry-pick r245815. rdar://problem/51264876
Added: branches/safari-607-branch/JSTests/stress/eliminate-arguments-negative-rest-access.js (0 => 246379)
--- branches/safari-607-branch/JSTests/stress/eliminate-arguments-negative-rest-access.js (rev 0)
+++ branches/safari-607-branch/JSTests/stress/eliminate-arguments-negative-rest-access.js 2019-06-12 22:20:54 UTC (rev 246379)
@@ -0,0 +1,16 @@
+//@ requireOptions("--forceEagerCompilation=1")
+
+function inlinee(index, value, ...rest) {
+ return rest[index | 0];
+}
+
+function opt() {
+ return inlinee(-1, 0x1234);
+}
+noInline(opt);
+
+for (let i = 0; i < 1e6; i++) {
+ const value = opt();
+ if (value !== undefined)
+ throw new Error(`${i}: ${value}`);
+}
Modified: branches/safari-607-branch/Source/_javascript_Core/ChangeLog (246378 => 246379)
--- branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-06-12 22:20:51 UTC (rev 246378)
+++ branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-06-12 22:20:54 UTC (rev 246379)
@@ -1,5 +1,49 @@
2019-06-12 Null <[email protected]>
+ Cherry-pick r246071. rdar://problem/51656838
+
+ Argument elimination should check for negative indices in GetByVal
+ https://bugs.webkit.org/show_bug.cgi?id=198302
+ <rdar://problem/51188095>
+
+ Reviewed by Filip Pizlo.
+
+ JSTests:
+
+ * stress/eliminate-arguments-negative-rest-access.js: Added.
+ (inlinee):
+ (opt):
+
+ Source/_javascript_Core:
+
+ In DFG::ArgumentEliminationPhase, the index is treated as unsigned, but there's no check
+ for overflow in the addition. In compileGetMyArgumentByVal, there's a check for overflow,
+ but the index is treated as signed, resulting in an index lower than numberOfArgumentsToSkip.
+
+ * dfg/DFGArgumentsEliminationPhase.cpp:
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246071 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-06-04 Tadeu Zagallo <[email protected]>
+
+ Argument elimination should check for negative indices in GetByVal
+ https://bugs.webkit.org/show_bug.cgi?id=198302
+ <rdar://problem/51188095>
+
+ Reviewed by Filip Pizlo.
+
+ In DFG::ArgumentEliminationPhase, the index is treated as unsigned, but there's no check
+ for overflow in the addition. In compileGetMyArgumentByVal, there's a check for overflow,
+ but the index is treated as signed, resulting in an index lower than numberOfArgumentsToSkip.
+
+ * dfg/DFGArgumentsEliminationPhase.cpp:
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+
+2019-06-12 Null <[email protected]>
+
Cherry-pick r246040. rdar://problem/51656856
[JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
Modified: branches/safari-607-branch/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp (246378 => 246379)
--- branches/safari-607-branch/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp 2019-06-12 22:20:51 UTC (rev 246378)
+++ branches/safari-607-branch/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp 2019-06-12 22:20:54 UTC (rev 246379)
@@ -756,11 +756,11 @@
InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame;
index += numberOfArgumentsToSkip;
- bool safeToGetStack;
+ bool safeToGetStack = index >= numberOfArgumentsToSkip;
if (inlineCallFrame)
- safeToGetStack = index < inlineCallFrame->argumentCountIncludingThis - 1;
+ safeToGetStack &= index < inlineCallFrame->argumentCountIncludingThis - 1;
else {
- safeToGetStack =
+ safeToGetStack &=
index < static_cast<unsigned>(codeBlock()->numParameters()) - 1;
}
if (safeToGetStack) {
Modified: branches/safari-607-branch/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (246378 => 246379)
--- branches/safari-607-branch/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-06-12 22:20:51 UTC (rev 246378)
+++ branches/safari-607-branch/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-06-12 22:20:54 UTC (rev 246379)
@@ -4232,13 +4232,15 @@
LValue numberOfArgs = m_out.sub(numberOfArgsIncludingThis, m_out.int32One);
LValue indexToCheck = originalIndex;
+ LValue numberOfArgumentsToSkip = m_out.int32Zero;
if (m_node->numberOfArgumentsToSkip()) {
- CheckValue* check = m_out.speculateAdd(indexToCheck, m_out.constInt32(m_node->numberOfArgumentsToSkip()));
+ numberOfArgumentsToSkip = m_out.constInt32(m_node->numberOfArgumentsToSkip());
+ CheckValue* check = m_out.speculateAdd(indexToCheck, numberOfArgumentsToSkip);
blessSpeculation(check, Overflow, noValue(), nullptr, m_origin);
indexToCheck = check;
}
- LValue isOutOfBounds = m_out.aboveOrEqual(indexToCheck, numberOfArgs);
+ LValue isOutOfBounds = m_out.bitOr(m_out.aboveOrEqual(indexToCheck, numberOfArgs), m_out.below(indexToCheck, numberOfArgumentsToSkip));
LBasicBlock continuation = nullptr;
LBasicBlock lastNext = nullptr;
ValueFromBlock slowResult;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
