Title: [255336] branches/safari-609-branch
- Revision
- 255336
- Author
- [email protected]
- Date
- 2020-01-28 19:17:13 -0800 (Tue, 28 Jan 2020)
Log Message
Apply patch. rdar://problem/58856012
Cherry-pick r254959. rdar://problem/58856012
2020-01-22 Keith Miller <[email protected]>
InternalField and CheckNeutered DF nodes are not always safe to execute
https://bugs.webkit.org/show_bug.cgi?id=206632
Reviewed by Saam Barati.
* stress/for-of-bad-internal-field-hoist.js: added.
(foo):
Modified Paths
Diff
Modified: branches/safari-609-branch/JSTests/ChangeLog (255335 => 255336)
--- branches/safari-609-branch/JSTests/ChangeLog 2020-01-29 03:09:14 UTC (rev 255335)
+++ branches/safari-609-branch/JSTests/ChangeLog 2020-01-29 03:17:13 UTC (rev 255336)
@@ -1,3 +1,21 @@
+2020-01-28 Russell Epstein <[email protected]>
+
+ Apply patch. rdar://problem/58856012
+
+ 2020-01-27 Mark Lam <[email protected]>
+
+ Cherry-pick r254959. rdar://problem/58856012
+
+ 2020-01-22 Keith Miller <[email protected]>
+
+ InternalField and CheckNeutered DFG nodes are not always safe to execute
+ https://bugs.webkit.org/show_bug.cgi?id=206632
+
+ Reviewed by Saam Barati.
+
+ * stress/for-of-bad-internal-field-hoist.js: Added.
+ (foo):
+
2020-01-27 Russell Epstein <[email protected]>
Cherry-pick r254788. rdar://problem/58856018
Modified: branches/safari-609-branch/Source/_javascript_Core/ChangeLog (255335 => 255336)
--- branches/safari-609-branch/Source/_javascript_Core/ChangeLog 2020-01-29 03:09:14 UTC (rev 255335)
+++ branches/safari-609-branch/Source/_javascript_Core/ChangeLog 2020-01-29 03:17:13 UTC (rev 255336)
@@ -1,3 +1,40 @@
+2020-01-28 Russell Epstein <[email protected]>
+
+ Apply patch. rdar://problem/58856012
+
+ 2020-01-27 Mark Lam <[email protected]>
+
+ Cherry-pick r254959. rdar://problem/58856012
+
+ Omitted parts concerning CheckNeutered because those are not applicable since
+ r254252 will not being merged to this branch.
+
+ 2020-01-22 Keith Miller <[email protected]>
+
+ InternalField and CheckNeutered DFG nodes are not always safe to execute
+ https://bugs.webkit.org/show_bug.cgi?id=206632
+
+ Reviewed by Saam Barati.
+
+ We currently mark (Get/Set)InternalField/CheckNeutered nodes as safe to execute everywhere. However,
+ GetInternalField, etc. rely on a proof that the cell passed to it is a subclass of InteralFieldObject.
+ This combination means we may hoist the nodes past the check guarding them.
+
+ Also, remove a bogus assertion that we will have proven the value passed to CheckNeutered is a TypedArray.
+ It's not valid to require that AI preserve a precise model of all invariants since phases can make changes
+ that AI doesn't understand.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileCheckNeutered):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileCheckNeutered):
+
2020-01-27 Russell Epstein <[email protected]>
Cherry-pick r254788. rdar://problem/58856018
Modified: branches/safari-609-branch/Source/_javascript_Core/dfg/DFGSafeToExecute.h (255335 => 255336)
--- branches/safari-609-branch/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2020-01-29 03:09:14 UTC (rev 255335)
+++ branches/safari-609-branch/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2020-01-29 03:17:13 UTC (rev 255336)
@@ -31,6 +31,12 @@
namespace JSC { namespace DFG {
+// This phase is used to determine if a node can safely run at a new location.
+// It is important to note that returning false does not mean it's definitely
+// wrong to run the node at the new location. In other words, returning false
+// does not imply moving the node would be invalid only that this phase could
+// not prove it is valid. Thus, it is always ok to return false.
+
template<typename AbstractStateType>
class SafeToExecuteEdge {
public:
@@ -289,8 +295,6 @@
case GetGlobalVar:
case GetGlobalLexicalVariable:
case PutGlobalVariable:
- case GetInternalField:
- case PutInternalField:
case CheckCell:
case CheckBadCell:
case CheckNotEmpty:
@@ -612,6 +616,10 @@
return true;
}
+ case GetInternalField:
+ case PutInternalField:
+ return false;
+
case DataViewSet:
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
