Diff
Modified: branches/safari-537-branch/LayoutTests/ChangeLog (153625 => 153626)
--- branches/safari-537-branch/LayoutTests/ChangeLog 2013-08-02 00:01:21 UTC (rev 153625)
+++ branches/safari-537-branch/LayoutTests/ChangeLog 2013-08-02 00:02:14 UTC (rev 153626)
@@ -1,5 +1,25 @@
2013-08-01 Lucas Forschler <[email protected]>
+ Merge r153615
+
+ 2013-08-01 Oliver Hunt <[email protected]>
+
+ DFG is not enforcing correct ordering of ToString conversion in MakeRope
+ https://bugs.webkit.org/show_bug.cgi?id=119408
+
+ Reviewed by Filip Pizlo.
+
+ Add tests
+
+ * fast/js/dfg-make-rope-side-effects-expected.txt: Added.
+ * fast/js/dfg-make-rope-side-effects.html: Added.
+ * fast/js/script-tests/dfg-make-rope-side-effects.js: Added.
+ (f):
+ (k.valueOf):
+ (k.toString):
+
+2013-08-01 Lucas Forschler <[email protected]>
+
Merge r153553
2013-07-31 Ryosuke Niwa <[email protected]>
Copied: branches/safari-537-branch/LayoutTests/fast/js/dfg-make-rope-side-effects-expected.txt (from rev 153615, trunk/LayoutTests/fast/js/dfg-make-rope-side-effects-expected.txt) (0 => 153626)
--- branches/safari-537-branch/LayoutTests/fast/js/dfg-make-rope-side-effects-expected.txt (rev 0)
+++ branches/safari-537-branch/LayoutTests/fast/js/dfg-make-rope-side-effects-expected.txt 2013-08-02 00:02:14 UTC (rev 153626)
@@ -0,0 +1,10 @@
+Check that the DFG can handle MakeRope on values that have side effects on [[ToPrimitive]].
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS testOutput.length is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-537-branch/LayoutTests/fast/js/dfg-make-rope-side-effects.html (from rev 153615, trunk/LayoutTests/fast/js/dfg-make-rope-side-effects.html) (0 => 153626)
--- branches/safari-537-branch/LayoutTests/fast/js/dfg-make-rope-side-effects.html (rev 0)
+++ branches/safari-537-branch/LayoutTests/fast/js/dfg-make-rope-side-effects.html 2013-08-02 00:02:14 UTC (rev 153626)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Copied: branches/safari-537-branch/LayoutTests/fast/js/script-tests/dfg-make-rope-side-effects.js (from rev 153615, trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-side-effects.js) (0 => 153626)
--- branches/safari-537-branch/LayoutTests/fast/js/script-tests/dfg-make-rope-side-effects.js (rev 0)
+++ branches/safari-537-branch/LayoutTests/fast/js/script-tests/dfg-make-rope-side-effects.js 2013-08-02 00:02:14 UTC (rev 153626)
@@ -0,0 +1,19 @@
+description(
+"Check that the DFG can handle MakeRope on values that have side effects on [[ToPrimitive]]."
+);
+
+function f(a,b,c,d,e) { return "1"+a+b+c+d+e+"6"; }
+noInline(f);
+var a=new String("2")
+var b = 5;
+var e = false;
+var k={valueOf:function(){return 4;}, toString:function(){return {}}}
+s=String
+
+var testOutput ="";
+while (!dfgCompiled({f:f}))
+ testOutput += f(a,new s(3),k, b, e);
+testOutput += f(a,new s(3),k, b, e);
+testOutput = testOutput.replace(/12345false6/g, "");
+shouldBe("testOutput.length", "0");
+
Modified: branches/safari-537-branch/Source/_javascript_Core/ChangeLog (153625 => 153626)
--- branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-08-02 00:01:21 UTC (rev 153625)
+++ branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-08-02 00:02:14 UTC (rev 153626)
@@ -1,3 +1,21 @@
+2013-08-01 Lucas Forschler <[email protected]>
+
+ Merge r153615
+
+ 2013-08-01 Oliver Hunt <[email protected]>
+
+ DFG is not enforcing correct ordering of ToString conversion in MakeRope
+ https://bugs.webkit.org/show_bug.cgi?id=119408
+
+ Reviewed by Filip Pizlo.
+
+ Construct ToString and Phantom nodes in advance of MakeRope
+ nodes to ensure that ordering is ensured, and correct values
+ will be reified on OSR exit.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+
2013-08-01 Mark Hahnenberg <[email protected]>
GetByVal on Arguments does the wrong size load when checking the Arguments object length
Modified: branches/safari-537-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (153625 => 153626)
--- branches/safari-537-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2013-08-02 00:01:21 UTC (rev 153625)
+++ branches/safari-537-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2013-08-02 00:02:14 UTC (rev 153626)
@@ -2352,11 +2352,18 @@
#else
const unsigned maxRopeArguments = 3;
#endif
+ OwnArrayPtr<Node*> toStringNodes = adoptArrayPtr(new Node*[numOperands]);
+ for (int i = 0; i < numOperands; i++)
+ toStringNodes[i] = addToGraph(ToString, get(startOperand + i));
+
+ for (int i = 0; i < numOperands; i++)
+ addToGraph(Phantom, toStringNodes[i]);
+
Node* operands[AdjacencyList::Size];
unsigned indexInOperands = 0;
for (unsigned i = 0; i < AdjacencyList::Size; ++i)
operands[i] = 0;
- for (int operandIdx = startOperand; operandIdx < startOperand + numOperands; ++operandIdx) {
+ for (int operandIdx = 0; operandIdx < numOperands; ++operandIdx) {
if (indexInOperands == maxRopeArguments) {
operands[0] = addToGraph(MakeRope, operands[0], operands[1], operands[2]);
for (unsigned i = 1; i < AdjacencyList::Size; ++i)
@@ -2366,7 +2373,7 @@
ASSERT(indexInOperands < AdjacencyList::Size);
ASSERT(indexInOperands < maxRopeArguments);
- operands[indexInOperands++] = addToGraph(ToString, get(operandIdx));
+ operands[indexInOperands++] = toStringNodes[operandIdx];
}
set(currentInstruction[1].u.operand,
addToGraph(MakeRope, operands[0], operands[1], operands[2]));
