Title: [284812] branches/safari-612-branch/Source/_javascript_Core
- Revision
- 284812
- Author
- [email protected]
- Date
- 2021-10-25 12:10:14 -0700 (Mon, 25 Oct 2021)
Log Message
Cherry-pick r284699. rdar://problem/84340372
canDoFastSpread should also check that the Structure is from the global object we're watching
https://bugs.webkit.org/show_bug.cgi?id=231976
<rdar://84340372>
Reviewed by Keith Miller.
Just reorder the checks for clarity.
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::canDoFastSpread):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-612-branch/Source/_javascript_Core/ChangeLog (284811 => 284812)
--- branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 19:10:10 UTC (rev 284811)
+++ branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 19:10:14 UTC (rev 284812)
@@ -1,5 +1,36 @@
2021-10-25 Null <[email protected]>
+ Cherry-pick r284699. rdar://problem/84340372
+
+ canDoFastSpread should also check that the Structure is from the global object we're watching
+ https://bugs.webkit.org/show_bug.cgi?id=231976
+ <rdar://84340372>
+
+ Reviewed by Keith Miller.
+
+ Just reorder the checks for clarity.
+
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::canDoFastSpread):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-22 Saam Barati <[email protected]>
+
+ canDoFastSpread should also check that the Structure is from the global object we're watching
+ https://bugs.webkit.org/show_bug.cgi?id=231976
+ <rdar://84340372>
+
+ Reviewed by Keith Miller.
+
+ Just reorder the checks for clarity.
+
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::canDoFastSpread):
+
+2021-10-25 Null <[email protected]>
+
Cherry-pick r284623. rdar://problem/84375007
Add missing overflow check to DFGIntegerRangeOptimizationPhase::filterConstant()
Modified: branches/safari-612-branch/Source/_javascript_Core/dfg/DFGGraph.cpp (284811 => 284812)
--- branches/safari-612-branch/Source/_javascript_Core/dfg/DFGGraph.cpp 2021-10-25 19:10:10 UTC (rev 284811)
+++ branches/safari-612-branch/Source/_javascript_Core/dfg/DFGGraph.cpp 2021-10-25 19:10:14 UTC (rev 284812)
@@ -1847,8 +1847,8 @@
ArrayPrototype* arrayPrototype = globalObject->arrayPrototype();
bool allGood = true;
value.m_structure.forEach([&] (RegisteredStructure structure) {
- allGood &= structure->hasMonoProto()
- && structure->globalObject() == globalObject
+ allGood &= structure->globalObject() == globalObject
+ && structure->hasMonoProto()
&& structure->storedPrototype() == arrayPrototype
&& !structure->isDictionary()
&& structure->getConcurrently(m_vm.propertyNames->iteratorSymbol.impl()) == invalidOffset
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
