Modified: trunk/JSTests/ChangeLog (266777 => 266778)
--- trunk/JSTests/ChangeLog 2020-09-09 11:33:08 UTC (rev 266777)
+++ trunk/JSTests/ChangeLog 2020-09-09 13:37:16 UTC (rev 266778)
@@ -1,3 +1,12 @@
+2020-09-09 Alexey Shvayka <[email protected]>
+
+ Don't emitDirectBinding() if there is a [...rest] element binding
+ https://bugs.webkit.org/show_bug.cgi?id=216228
+
+ Reviewed by Darin Adler.
+
+ * test262/expectations.yaml: Mark 12 test cases as passing.
+
2020-09-08 Yusuke Suzuki <[email protected]>
[JSC] returnEarlyFromInfiniteLoopsForFuzzing should return object
Modified: trunk/JSTests/test262/expectations.yaml (266777 => 266778)
--- trunk/JSTests/test262/expectations.yaml 2020-09-09 11:33:08 UTC (rev 266777)
+++ trunk/JSTests/test262/expectations.yaml 2020-09-09 13:37:16 UTC (rev 266778)
@@ -2927,9 +2927,6 @@
test/language/statements/const/dstr/ary-ptrn-elem-id-iter-val-array-prototype.js:
default: 'Test262Error: Expected SameValue(«3», «42») to be true'
strict mode: 'Test262Error: Expected SameValue(«3», «42») to be true'
-test/language/statements/const/dstr/ary-ptrn-rest-id-direct.js:
- default: 'Test262Error: Expected true but got false'
- strict mode: 'Test262Error: Expected true but got false'
test/language/statements/for-await-of/async-from-sync-iterator-continuation-abrupt-completion-get-constructor.js:
default: 'Test262:AsyncTestFailure:Test262Error: Test262Error: Expected [start, tick 1, tick 2] and [start, tick 1, tick 2, catch] to have the same contents. '
strict mode: 'Test262:AsyncTestFailure:Test262Error: Test262Error: Expected [start, tick 1, tick 2] and [start, tick 1, tick 2, catch] to have the same contents. '
@@ -3033,9 +3030,6 @@
test/language/statements/for/dstr/const-ary-ptrn-elem-id-iter-val-array-prototype.js:
default: 'Test262Error: Expected SameValue(«3», «42») to be true'
strict mode: 'Test262Error: Expected SameValue(«3», «42») to be true'
-test/language/statements/for/dstr/const-ary-ptrn-rest-id-direct.js:
- default: 'Test262Error: Expected true but got false'
- strict mode: 'Test262Error: Expected true but got false'
test/language/statements/for/dstr/let-ary-init-iter-get-err-array-prototype.js:
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
@@ -3042,9 +3036,6 @@
test/language/statements/for/dstr/let-ary-ptrn-elem-id-iter-val-array-prototype.js:
default: 'Test262Error: Expected SameValue(«3», «42») to be true'
strict mode: 'Test262Error: Expected SameValue(«3», «42») to be true'
-test/language/statements/for/dstr/let-ary-ptrn-rest-id-direct.js:
- default: 'Test262Error: Expected true but got false'
- strict mode: 'Test262Error: Expected true but got false'
test/language/statements/for/dstr/var-ary-init-iter-get-err-array-prototype.js:
default: 'Test262Error: Expected a TypeError but got a ReferenceError'
strict mode: 'Test262Error: Expected a TypeError but got a ReferenceError'
@@ -3051,9 +3042,6 @@
test/language/statements/for/dstr/var-ary-ptrn-elem-id-iter-val-array-prototype.js:
default: 'Test262Error: Expected SameValue(«3», «42») to be true'
strict mode: 'Test262Error: Expected SameValue(«3», «42») to be true'
-test/language/statements/for/dstr/var-ary-ptrn-rest-id-direct.js:
- default: 'Test262Error: Expected true but got false'
- strict mode: 'Test262Error: Expected true but got false'
test/language/statements/for/head-lhs-let.js:
default: "SyntaxError: Unexpected token ';'. Expected a parameter pattern or a ')' in parameter list."
test/language/statements/for/scope-body-lex-open.js:
@@ -3105,9 +3093,6 @@
test/language/statements/let/dstr/ary-ptrn-elem-id-iter-val-array-prototype.js:
default: 'Test262Error: Expected SameValue(«3», «42») to be true'
strict mode: 'Test262Error: Expected SameValue(«3», «42») to be true'
-test/language/statements/let/dstr/ary-ptrn-rest-id-direct.js:
- default: 'Test262Error: Expected true but got false'
- strict mode: 'Test262Error: Expected true but got false'
test/language/statements/let/syntax/escaped-let.js:
default: "SyntaxError: Unexpected escaped characters in keyword token: 'l\\u0065t'"
test/language/statements/switch/syntax/redeclaration/async-function-name-redeclaration-attempt-with-async-function.js:
@@ -3214,9 +3199,6 @@
test/language/statements/variable/dstr/ary-ptrn-elem-id-iter-val-array-prototype.js:
default: 'Test262Error: Expected SameValue(«3», «42») to be true'
strict mode: 'Test262Error: Expected SameValue(«3», «42») to be true'
-test/language/statements/variable/dstr/ary-ptrn-rest-id-direct.js:
- default: 'Test262Error: Expected true but got false'
- strict mode: 'Test262Error: Expected true but got false'
test/language/types/reference/put-value-prop-base-primitive-realm.js:
default: 'Test262Error: number Expected SameValue(«0», «1») to be true'
strict mode: 'Test262Error: number Expected SameValue(«0», «1») to be true'
Modified: trunk/Source/_javascript_Core/ChangeLog (266777 => 266778)
--- trunk/Source/_javascript_Core/ChangeLog 2020-09-09 11:33:08 UTC (rev 266777)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-09-09 13:37:16 UTC (rev 266778)
@@ -1,3 +1,21 @@
+2020-09-09 Alexey Shvayka <[email protected]>
+
+ Don't emitDirectBinding() if there is a [...rest] element binding
+ https://bugs.webkit.org/show_bug.cgi?id=216228
+
+ Reviewed by Darin Adler.
+
+ emitDirectBinding() is up for removal due to not respecting overriden or removed
+ Array.prototype[Symbol.iterator]. However, dropping it slows down popular swap pattern
+ `[a, b] = [b, a]` by 40% with DFG/FTL, and by a factor of 6 with baseline JIT only.
+
+ Until we figure out the best way to preserve common case performance, this patch
+ prevents `let [...rest] = [1]` from ending up as a number instead of an array,
+ aligning JSC with V8 and SpiderMonkey.
+
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::ArrayPatternNode::emitDirectBinding):
+
2020-09-08 Yusuke Suzuki <[email protected]>
[JSC] returnEarlyFromInfiniteLoopsForFuzzing should return object
Modified: trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp (266777 => 266778)
--- trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2020-09-09 11:33:08 UTC (rev 266777)
+++ trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2020-09-09 13:37:16 UTC (rev 266778)
@@ -5106,6 +5106,9 @@
if (!rhs->isSimpleArray())
return nullptr;
+ if (m_targetPatterns.findMatching([&] (auto& target) { return target.bindingType == BindingType::RestElement; }) != notFound)
+ return nullptr;
+
ElementNode* elementNodes = static_cast<ArrayNode*>(rhs)->elements();
Vector<ExpressionNode*> elements;
for (; elementNodes; elementNodes = elementNodes->next()) {
