Diff
Modified: trunk/LayoutTests/ChangeLog (153614 => 153615)
--- trunk/LayoutTests/ChangeLog 2013-08-01 22:15:34 UTC (rev 153614)
+++ trunk/LayoutTests/ChangeLog 2013-08-01 22:18:58 UTC (rev 153615)
@@ -1,3 +1,19 @@
+2013-08-01 Oliver Hunt <[email protected]>
+
+ DFG is not enforcing correct ordering of ToString conversion in MakeRope
+ https://bugs.webkit.org/show_bug.cgi?id=119408
+
+ Reviewed by Filip Pizlo.
+
+ Add tests
+
+ * fast/js/dfg-make-rope-side-effects-expected.txt: Added.
+ * fast/js/dfg-make-rope-side-effects.html: Added.
+ * fast/js/script-tests/dfg-make-rope-side-effects.js: Added.
+ (f):
+ (k.valueOf):
+ (k.toString):
+
2013-08-01 Filip Pizlo <[email protected]>
DFG optimizations don't handle neutered arrays properly
Added: trunk/LayoutTests/fast/js/dfg-make-rope-side-effects-expected.txt (0 => 153615)
--- trunk/LayoutTests/fast/js/dfg-make-rope-side-effects-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-make-rope-side-effects-expected.txt 2013-08-01 22:18:58 UTC (rev 153615)
@@ -0,0 +1,10 @@
+Check that the DFG can handle MakeRope on values that have side effects on [[ToPrimitive]].
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS testOutput.length is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-make-rope-side-effects.html (0 => 153615)
--- trunk/LayoutTests/fast/js/dfg-make-rope-side-effects.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-make-rope-side-effects.html 2013-08-01 22:18:58 UTC (rev 153615)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-side-effects.js (0 => 153615)
--- trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-side-effects.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-side-effects.js 2013-08-01 22:18:58 UTC (rev 153615)
@@ -0,0 +1,19 @@
+description(
+"Check that the DFG can handle MakeRope on values that have side effects on [[ToPrimitive]]."
+);
+
+function f(a,b,c,d,e) { return "1"+a+b+c+d+e+"6"; }
+noInline(f);
+var a=new String("2")
+var b = 5;
+var e = false;
+var k={valueOf:function(){return 4;}, toString:function(){return {}}}
+s=String
+
+var testOutput ="";
+while (!dfgCompiled({f:f}))
+ testOutput += f(a,new s(3),k, b, e);
+testOutput += f(a,new s(3),k, b, e);
+testOutput = testOutput.replace(/12345false6/g, "");
+shouldBe("testOutput.length", "0");
+
Modified: trunk/Source/_javascript_Core/ChangeLog (153614 => 153615)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-01 22:15:34 UTC (rev 153614)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-01 22:18:58 UTC (rev 153615)
@@ -1,3 +1,17 @@
+2013-08-01 Oliver Hunt <[email protected]>
+
+ DFG is not enforcing correct ordering of ToString conversion in MakeRope
+ https://bugs.webkit.org/show_bug.cgi?id=119408
+
+ Reviewed by Filip Pizlo.
+
+ Construct ToString and Phantom nodes in advance of MakeRope
+ nodes to ensure that ordering is ensured, and correct values
+ will be reified on OSR exit.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+
2013-08-01 Michael Saboff <[email protected]>
REGRESSION: Crash beneath cti_vm_throw_slowpath due to invalid CallFrame pointer
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (153614 => 153615)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2013-08-01 22:15:34 UTC (rev 153614)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2013-08-01 22:18:58 UTC (rev 153615)
@@ -2148,11 +2148,18 @@
#else
const unsigned maxRopeArguments = 3;
#endif
+ OwnArrayPtr<Node*> toStringNodes = adoptArrayPtr(new Node*[numOperands]);
+ for (int i = 0; i < numOperands; i++)
+ toStringNodes[i] = addToGraph(ToString, get(startOperand + i));
+
+ for (int i = 0; i < numOperands; i++)
+ addToGraph(Phantom, toStringNodes[i]);
+
Node* operands[AdjacencyList::Size];
unsigned indexInOperands = 0;
for (unsigned i = 0; i < AdjacencyList::Size; ++i)
operands[i] = 0;
- for (int operandIdx = startOperand; operandIdx < startOperand + numOperands; ++operandIdx) {
+ for (int operandIdx = 0; operandIdx < numOperands; ++operandIdx) {
if (indexInOperands == maxRopeArguments) {
operands[0] = addToGraph(MakeRope, operands[0], operands[1], operands[2]);
for (unsigned i = 1; i < AdjacencyList::Size; ++i)
@@ -2162,7 +2169,7 @@
ASSERT(indexInOperands < AdjacencyList::Size);
ASSERT(indexInOperands < maxRopeArguments);
- operands[indexInOperands++] = addToGraph(ToString, get(operandIdx));
+ operands[indexInOperands++] = toStringNodes[operandIdx];
}
set(currentInstruction[1].u.operand,
addToGraph(MakeRope, operands[0], operands[1], operands[2]));
