Title: [280716] trunk
- Revision
- 280716
- Author
- [email protected]
- Date
- 2021-08-05 18:59:40 -0700 (Thu, 05 Aug 2021)
Log Message
Assertion failure when checking array in DFG (32 bits)
https://bugs.webkit.org/show_bug.cgi?id=228839
Patch by Mikhail R. Gadelha <[email protected]> on 2021-08-05
Reviewed by Yusuke Suzuki.
JSTests:
* stress/check-array-empty-32.js: Added.
(a.b.catch.print.c):
(a.b):
(a.e):
(a):
Source/_javascript_Core:
Since empty values don't pass the cell check in 32 bits, we need to
guard the SpecEmpty check to only happen in 64 bits archs
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (280715 => 280716)
--- trunk/JSTests/ChangeLog 2021-08-06 01:56:58 UTC (rev 280715)
+++ trunk/JSTests/ChangeLog 2021-08-06 01:59:40 UTC (rev 280716)
@@ -1,3 +1,16 @@
+2021-08-05 Mikhail R. Gadelha <[email protected]>
+
+ Assertion failure when checking array in DFG (32 bits)
+ https://bugs.webkit.org/show_bug.cgi?id=228839
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/check-array-empty-32.js: Added.
+ (a.b.catch.print.c):
+ (a.b):
+ (a.e):
+ (a):
+
2021-08-02 Yusuke Suzuki <[email protected]>
[JSC] Yarr BoyerMoore search should support character-class
Added: trunk/JSTests/stress/check-array-empty-32.js (0 => 280716)
--- trunk/JSTests/stress/check-array-empty-32.js (rev 0)
+++ trunk/JSTests/stress/check-array-empty-32.js 2021-08-06 01:59:40 UTC (rev 280716)
@@ -0,0 +1,15 @@
+function __f_0() { return arguments }
+
+function __f_1(__v_4) {
+ var __v_6
+ if(__v_4)
+ __v_6 = __f_0()
+
+ {}
+
+ __v_6[2]
+}
+
+for (i = 0; i < 100; ++i) {
+ __f_1(1)
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (280715 => 280716)
--- trunk/Source/_javascript_Core/ChangeLog 2021-08-06 01:56:58 UTC (rev 280715)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-08-06 01:59:40 UTC (rev 280716)
@@ -1,3 +1,16 @@
+2021-08-05 Mikhail R. Gadelha <[email protected]>
+
+ Assertion failure when checking array in DFG (32 bits)
+ https://bugs.webkit.org/show_bug.cgi?id=228839
+
+ Reviewed by Yusuke Suzuki.
+
+ Since empty values don't pass the cell check in 32 bits, we need to
+ guard the SpecEmpty check to only happen in 64 bits archs
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::checkArray):
+
2021-08-05 Robin Morisset <[email protected]>
REGRESSION (r280507): ASSERTION FAILED: !undominatedPhis.contains(value) in JSC::B3::(anonymous namespace)::Validater::validatePhisAreDominatedByUpsilons()
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (280715 => 280716)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-08-06 01:56:58 UTC (rev 280715)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-08-06 01:59:40 UTC (rev 280716)
@@ -858,7 +858,9 @@
if (arrayMode.alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1()))) {
// We can purge Empty check completely in this case of CheckArrayOrEmpty since CellUse only accepts SpecCell | SpecEmpty.
+#if USE(JSVALUE64)
ASSERT(typeFilterFor(node->child1().useKind()) & SpecEmpty);
+#endif
noResult(m_currentNode);
return;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
