Diff
Modified: trunk/LayoutTests/ChangeLog (131641 => 131642)
--- trunk/LayoutTests/ChangeLog 2012-10-17 21:10:33 UTC (rev 131641)
+++ trunk/LayoutTests/ChangeLog 2012-10-17 21:12:52 UTC (rev 131642)
@@ -1,3 +1,17 @@
+2012-10-17 Filip Pizlo <[email protected]>
+
+ JIT op_get_by_pname should call cti_get_by_val_generic and not cti_get_by_val
+ https://bugs.webkit.org/show_bug.cgi?id=99631
+ <rdar://problem/12483221>
+
+ Reviewed by Mark Hahnenberg.
+
+ * fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val-expected.txt: Added.
+ * fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val.html: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/get-by-pname-that-looks-like-a-patchable-get-by-val.js: Added.
+ (foo):
+
2012-10-17 Tony Chang <[email protected]>
Unreviewed, second set of GTK+ baselines for shadow DOM changes to RenderSlider.
Added: trunk/LayoutTests/fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val-expected.txt (0 => 131642)
--- trunk/LayoutTests/fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val-expected.txt 2012-10-17 21:12:52 UTC (rev 131642)
@@ -0,0 +1,10 @@
+Tests that using get_by_pname in a way that appears like a get_by_val that can be patched does not cause the patching machinery to crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo() is 300
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val.html (0 => 131642)
--- trunk/LayoutTests/fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val.html (rev 0)
+++ trunk/LayoutTests/fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val.html 2012-10-17 21:12:52 UTC (rev 131642)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/fast/js/jsc-test-list (131641 => 131642)
--- trunk/LayoutTests/fast/js/jsc-test-list 2012-10-17 21:10:33 UTC (rev 131641)
+++ trunk/LayoutTests/fast/js/jsc-test-list 2012-10-17 21:12:52 UTC (rev 131642)
@@ -204,6 +204,7 @@
fast/js/getter-setter-gc
fast/js/get-by-pname
fast/js/get-by-pname-non-final-object
+fast/js/get-by-pname-that-looks-like-a-patchable-get-by-val
fast/js/global-resolve-through-eval
fast/js/gmail-re-re
fast/js/has-own-property
Added: trunk/LayoutTests/fast/js/script-tests/get-by-pname-that-looks-like-a-patchable-get-by-val.js (0 => 131642)
--- trunk/LayoutTests/fast/js/script-tests/get-by-pname-that-looks-like-a-patchable-get-by-val.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/get-by-pname-that-looks-like-a-patchable-get-by-val.js 2012-10-17 21:12:52 UTC (rev 131642)
@@ -0,0 +1,21 @@
+description(
+"Tests that using get_by_pname in a way that appears like a get_by_val that can be patched does not cause the patching machinery to crash."
+);
+
+function foo() {
+ var o = [1, 2, 3];
+ var result = 0;
+
+ for (var i = 0; i < 100; ++i) {
+ for (var s in o) {
+ s = 0;
+ result += o[s];
+ }
+ }
+
+ return result;
+}
+
+shouldBe("foo()", "300");
+
+
Modified: trunk/Source/_javascript_Core/ChangeLog (131641 => 131642)
--- trunk/Source/_javascript_Core/ChangeLog 2012-10-17 21:10:33 UTC (rev 131641)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-10-17 21:12:52 UTC (rev 131642)
@@ -1,3 +1,19 @@
+2012-10-17 Filip Pizlo <[email protected]>
+
+ JIT op_get_by_pname should call cti_get_by_val_generic and not cti_get_by_val
+ https://bugs.webkit.org/show_bug.cgi?id=99631
+ <rdar://problem/12483221>
+
+ Reviewed by Mark Hahnenberg.
+
+ cti_get_by_val assumes that the return address has patching metadata associated with it, which won't
+ be true for op_get_by_pname. cti_get_by_val_generic makes no such assumptions.
+
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emitSlow_op_get_by_pname):
+ * jit/JITPropertyAccess32_64.cpp:
+ (JSC::JIT::emitSlow_op_get_by_pname):
+
2012-10-17 Mark Hahnenberg <[email protected]>
Block freeing thread should sleep indefinitely when there's no work to do
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (131641 => 131642)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2012-10-17 21:10:33 UTC (rev 131641)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2012-10-17 21:12:52 UTC (rev 131642)
@@ -278,7 +278,7 @@
linkSlowCase(iter);
linkSlowCase(iter);
- JITStubCall stubCall(this, cti_op_get_by_val);
+ JITStubCall stubCall(this, cti_op_get_by_val_generic);
stubCall.addArgument(base, regT2);
stubCall.addArgument(property, regT2);
stubCall.call(dst);
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp (131641 => 131642)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp 2012-10-17 21:10:33 UTC (rev 131641)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp 2012-10-17 21:12:52 UTC (rev 131642)
@@ -1226,7 +1226,7 @@
linkSlowCase(iter);
linkSlowCase(iter);
- JITStubCall stubCall(this, cti_op_get_by_val);
+ JITStubCall stubCall(this, cti_op_get_by_val_generic);
stubCall.addArgument(base);
stubCall.addArgument(property);
stubCall.call(dst);
