Diff
Modified: trunk/LayoutTests/ChangeLog (139108 => 139109)
--- trunk/LayoutTests/ChangeLog 2013-01-08 21:54:32 UTC (rev 139108)
+++ trunk/LayoutTests/ChangeLog 2013-01-08 22:02:04 UTC (rev 139109)
@@ -1,3 +1,17 @@
+2013-01-08 Filip Pizlo <[email protected]>
+
+ REGRESSION (r138921): Crash in JSC::Arguments::create
+ https://bugs.webkit.org/show_bug.cgi?id=106329
+ <rdar://problem/12974196>
+
+ Reviewed by Mark Hahnenberg.
+
+ * fast/js/dfg-create-inlined-arguments-in-closure-inline-expected.txt: Added.
+ * fast/js/dfg-create-inlined-arguments-in-closure-inline.html: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/dfg-create-inlined-arguments-in-closure-inline.js: Added.
+ (foo):
+
2013-01-08 Martin Robinson <[email protected]>
Layout Test http/tests/misc/authentication-redirect-4/authentication-sent-to-redirect-same-origin-url.html is timing out
Added: trunk/LayoutTests/fast/js/dfg-create-inlined-arguments-in-closure-inline-expected.txt (0 => 139109)
--- trunk/LayoutTests/fast/js/dfg-create-inlined-arguments-in-closure-inline-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-create-inlined-arguments-in-closure-inline-expected.txt 2013-01-08 22:02:04 UTC (rev 139109)
@@ -0,0 +1,209 @@
+Tests that if the DFG tries to create inlined arguments from within a inlined call frame corresponding to a closure call, then we don't crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS value is 5
+PASS value is 6
+PASS value is 7
+PASS value is 8
+PASS value is 9
+PASS value is 10
+PASS value is 11
+PASS value is 12
+PASS value is 13
+PASS value is 14
+PASS value is 15
+PASS value is 16
+PASS value is 17
+PASS value is 18
+PASS value is 19
+PASS value is 20
+PASS value is 21
+PASS value is 22
+PASS value is 23
+PASS value is 24
+PASS value is 25
+PASS value is 26
+PASS value is 27
+PASS value is 28
+PASS value is 29
+PASS value is 30
+PASS value is 31
+PASS value is 32
+PASS value is 33
+PASS value is 34
+PASS value is 35
+PASS value is 36
+PASS value is 37
+PASS value is 38
+PASS value is 39
+PASS value is 40
+PASS value is 41
+PASS value is 42
+PASS value is 43
+PASS value is 44
+PASS value is 45
+PASS value is 46
+PASS value is 47
+PASS value is 48
+PASS value is 49
+PASS value is 50
+PASS value is 51
+PASS value is 52
+PASS value is 53
+PASS value is 54
+PASS value is 55
+PASS value is 56
+PASS value is 57
+PASS value is 58
+PASS value is 59
+PASS value is 60
+PASS value is 61
+PASS value is 62
+PASS value is 63
+PASS value is 64
+PASS value is 65
+PASS value is 66
+PASS value is 67
+PASS value is 68
+PASS value is 69
+PASS value is 70
+PASS value is 71
+PASS value is 72
+PASS value is 73
+PASS value is 74
+PASS value is 75
+PASS value is 76
+PASS value is 77
+PASS value is 78
+PASS value is 79
+PASS value is 80
+PASS value is 81
+PASS value is 82
+PASS value is 83
+PASS value is 84
+PASS value is 85
+PASS value is 86
+PASS value is 87
+PASS value is 88
+PASS value is 89
+PASS value is 90
+PASS value is 91
+PASS value is 92
+PASS value is 93
+PASS value is 94
+PASS value is 95
+PASS value is 96
+PASS value is 97
+PASS value is 98
+PASS value is 99
+PASS value is 100
+PASS value is 101
+PASS value is 102
+PASS value is 103
+PASS value is 104
+PASS value is 105
+PASS value is 106
+PASS value is 107
+PASS value is 108
+PASS value is 109
+PASS value is 110
+PASS value is 111
+PASS value is 112
+PASS value is 113
+PASS value is 114
+PASS value is 115
+PASS value is 116
+PASS value is 117
+PASS value is 118
+PASS value is 119
+PASS value is 120
+PASS value is 121
+PASS value is 122
+PASS value is 123
+PASS value is 124
+PASS value is 125
+PASS value is 126
+PASS value is 127
+PASS value is 128
+PASS value is 129
+PASS value is 130
+PASS value is 131
+PASS value is 132
+PASS value is 133
+PASS value is 134
+PASS value is 135
+PASS value is 136
+PASS value is 137
+PASS value is 138
+PASS value is 139
+PASS value is 140
+PASS value is 141
+PASS value is 142
+PASS value is 143
+PASS value is 144
+PASS value is 145
+PASS value is 146
+PASS value is 147
+PASS value is 148
+PASS value is 149
+PASS value is 150
+PASS value is 151
+PASS value is 152
+PASS value is 153
+PASS value is 154
+PASS value is 155
+PASS value is 156
+PASS value is 157
+PASS value is 158
+PASS value is 159
+PASS value is 160
+PASS value is 161
+PASS value is 162
+PASS value is 163
+PASS value is 164
+PASS value is 165
+PASS value is 166
+PASS value is 167
+PASS value is 168
+PASS value is 169
+PASS value is 170
+PASS value is 171
+PASS value is 172
+PASS value is 173
+PASS value is 174
+PASS value is 175
+PASS value is 176
+PASS value is 177
+PASS value is 178
+PASS value is 179
+PASS value is 180
+PASS value is 181
+PASS value is 182
+PASS value is 183
+PASS value is 184
+PASS value is 185
+PASS value is 186
+PASS value is 187
+PASS value is 188
+PASS value is 189
+PASS value is 190
+PASS value is 191
+PASS value is 192
+PASS value is 193
+PASS value is 194
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS value is 5.5
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-create-inlined-arguments-in-closure-inline.html (0 => 139109)
--- trunk/LayoutTests/fast/js/dfg-create-inlined-arguments-in-closure-inline.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-create-inlined-arguments-in-closure-inline.html 2013-01-08 22:02:04 UTC (rev 139109)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/fast/js/jsc-test-list (139108 => 139109)
--- trunk/LayoutTests/fast/js/jsc-test-list 2013-01-08 21:54:32 UTC (rev 139108)
+++ trunk/LayoutTests/fast/js/jsc-test-list 2013-01-08 22:02:04 UTC (rev 139109)
@@ -96,6 +96,7 @@
fast/js/dfg-check-structure-elimination-for-non-cell
fast/js/dfg-constant-fold-first-local-read-after-block-merge
fast/js/dfg-convert-this-dom-window
+fast/js/dfg-create-inlined-arguments-in-closure-inline
fast/js/dfg-cse-cfa-discrepancy
fast/js/dfg-cse-dead-get-scoped-var
fast/js/dfg-dead-min-one-arg
Added: trunk/LayoutTests/fast/js/script-tests/dfg-create-inlined-arguments-in-closure-inline.js (0 => 139109)
--- trunk/LayoutTests/fast/js/script-tests/dfg-create-inlined-arguments-in-closure-inline.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-create-inlined-arguments-in-closure-inline.js 2013-01-08 22:02:04 UTC (rev 139109)
@@ -0,0 +1,20 @@
+description(
+"Tests that if the DFG tries to create inlined arguments from within a inlined call frame corresponding to a closure call, then we don't crash."
+);
+
+function foo(x, f) {
+ return f(x, 5)[0];
+}
+
+for (var i = 0; i < 200; ++i) {
+ var value = foo(i < 190 ? i : 0.5, function() {
+ var result = 0;
+ for (var j = 0; j < arguments.length; ++j)
+ result += arguments[j];
+ return [result, arguments];
+ });
+ if (i < 190)
+ shouldBe("value", "" + (i + 5));
+ else
+ shouldBe("value", "5.5");
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (139108 => 139109)
--- trunk/Source/_javascript_Core/ChangeLog 2013-01-08 21:54:32 UTC (rev 139108)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-01-08 22:02:04 UTC (rev 139109)
@@ -1,5 +1,24 @@
2013-01-08 Filip Pizlo <[email protected]>
+ REGRESSION (r138921): Crash in JSC::Arguments::create
+ https://bugs.webkit.org/show_bug.cgi?id=106329
+ <rdar://problem/12974196>
+
+ Reviewed by Mark Hahnenberg.
+
+ Arguments::finishCreation() that takes an InlineCallFrame* needs to understand that the callee can
+ be unset, indicating that the callee needs to be loaded from the true call frame. This adds a
+ method to InlineCallFrame to do just that.
+
+ * bytecode/CodeOrigin.cpp:
+ (JSC::InlineCallFrame::calleeForCallFrame):
+ * bytecode/CodeOrigin.h:
+ (InlineCallFrame):
+ * runtime/Arguments.h:
+ (JSC::Arguments::finishCreation):
+
+2013-01-08 Filip Pizlo <[email protected]>
+
DFG initrinsic handling should ensure that we backwards propagate the fact that all operands may escape
https://bugs.webkit.org/show_bug.cgi?id=106365
Modified: trunk/Source/_javascript_Core/bytecode/CodeOrigin.cpp (139108 => 139109)
--- trunk/Source/_javascript_Core/bytecode/CodeOrigin.cpp 2013-01-08 21:54:32 UTC (rev 139108)
+++ trunk/Source/_javascript_Core/bytecode/CodeOrigin.cpp 2013-01-08 22:02:04 UTC (rev 139109)
@@ -26,6 +26,7 @@
#include "config.h"
#include "CodeOrigin.h"
+#include "CallFrame.h"
#include "CodeBlock.h"
#include "Executable.h"
@@ -72,6 +73,14 @@
}
}
+JSFunction* InlineCallFrame::calleeForCallFrame(ExecState* exec) const
+{
+ if (!isClosureCall())
+ return callee.get();
+
+ return jsCast<JSFunction*>((exec + stackOffset)->callee());
+}
+
CodeBlockHash InlineCallFrame::hash() const
{
return executable->hashFor(specializationKind());
Modified: trunk/Source/_javascript_Core/bytecode/CodeOrigin.h (139108 => 139109)
--- trunk/Source/_javascript_Core/bytecode/CodeOrigin.h 2013-01-08 21:54:32 UTC (rev 139108)
+++ trunk/Source/_javascript_Core/bytecode/CodeOrigin.h 2013-01-08 22:02:04 UTC (rev 139109)
@@ -38,6 +38,7 @@
namespace JSC {
struct InlineCallFrame;
+class ExecState;
class ExecutableBase;
class JSFunction;
@@ -110,6 +111,9 @@
bool isClosureCall() const { return !callee; }
+ // Get the callee given a machine call frame to which this InlineCallFrame belongs.
+ JSFunction* calleeForCallFrame(ExecState*) const;
+
String inferredName() const;
CodeBlockHash hash() const;
Modified: trunk/Source/_javascript_Core/runtime/Arguments.h (139108 => 139109)
--- trunk/Source/_javascript_Core/runtime/Arguments.h 2013-01-08 21:54:32 UTC (rev 139108)
+++ trunk/Source/_javascript_Core/runtime/Arguments.h 2013-01-08 22:02:04 UTC (rev 139109)
@@ -259,7 +259,7 @@
Base::finishCreation(callFrame->globalData());
ASSERT(inherits(&s_info));
- JSFunction* callee = inlineCallFrame->callee.get();
+ JSFunction* callee = inlineCallFrame->calleeForCallFrame(callFrame);
m_numArguments = inlineCallFrame->arguments.size() - 1;
m_registers = reinterpret_cast<WriteBarrierBase<Unknown>*>(callFrame->registers()) + inlineCallFrame->stackOffset;
m_callee.set(callFrame->globalData(), this, callee);
