Title: [156211] trunk
- Revision
- 156211
- Author
- [email protected]
- Date
- 2013-09-20 17:00:30 -0700 (Fri, 20 Sep 2013)
Log Message
REGRESSION(r153215): New iCloud site crashes
https://bugs.webkit.org/show_bug.cgi?id=121710
Reviewed by Filip Pizlo.
Source/_javascript_Core:
Don't claim to be able to rely on the arguments structure, use the Arguments
speculation type
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
LayoutTests:
New test case
* js/dfg-arguments-mutated-structure-expected.txt: Added.
* js/dfg-arguments-mutated-structure.html: Added.
* js/script-tests/dfg-arguments-mutated-structure.js: Added.
(foo):
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (156210 => 156211)
--- trunk/LayoutTests/ChangeLog 2013-09-20 23:59:19 UTC (rev 156210)
+++ trunk/LayoutTests/ChangeLog 2013-09-21 00:00:30 UTC (rev 156211)
@@ -1,3 +1,17 @@
+2013-09-20 Oliver Hunt <[email protected]>
+
+ REGRESSION(r153215): New iCloud site crashes
+ https://bugs.webkit.org/show_bug.cgi?id=121710
+
+ Reviewed by Filip Pizlo.
+
+ New test case
+
+ * js/dfg-arguments-mutated-structure-expected.txt: Added.
+ * js/dfg-arguments-mutated-structure.html: Added.
+ * js/script-tests/dfg-arguments-mutated-structure.js: Added.
+ (foo):
+
2013-09-20 Commit Queue <[email protected]>
Unreviewed, rolling out r156185.
Added: trunk/LayoutTests/js/dfg-arguments-mutated-structure-expected.txt (0 => 156211)
--- trunk/LayoutTests/js/dfg-arguments-mutated-structure-expected.txt (rev 0)
+++ trunk/LayoutTests/js/dfg-arguments-mutated-structure-expected.txt 2013-09-21 00:00:30 UTC (rev 156211)
@@ -0,0 +1,10 @@
+Tests effect of mutating Arguments object's structure.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo() is true on all iterations including after DFG tier-up.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/dfg-arguments-mutated-structure.html (0 => 156211)
--- trunk/LayoutTests/js/dfg-arguments-mutated-structure.html (rev 0)
+++ trunk/LayoutTests/js/dfg-arguments-mutated-structure.html 2013-09-21 00:00:30 UTC (rev 156211)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/script-tests/dfg-arguments-mutated-structure.js (0 => 156211)
--- trunk/LayoutTests/js/script-tests/dfg-arguments-mutated-structure.js (rev 0)
+++ trunk/LayoutTests/js/script-tests/dfg-arguments-mutated-structure.js 2013-09-21 00:00:30 UTC (rev 156211)
@@ -0,0 +1,9 @@
+description(
+"Tests effect of mutating Arguments object's structure."
+);
+function foo() {
+ arguments.a=true;
+ return arguments.a;
+}
+
+dfgShouldBe(foo, "foo()", "true");
Modified: trunk/Source/_javascript_Core/ChangeLog (156210 => 156211)
--- trunk/Source/_javascript_Core/ChangeLog 2013-09-20 23:59:19 UTC (rev 156210)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-09-21 00:00:30 UTC (rev 156211)
@@ -1,3 +1,16 @@
+2013-09-20 Oliver Hunt <[email protected]>
+
+ REGRESSION(r153215): New iCloud site crashes
+ https://bugs.webkit.org/show_bug.cgi?id=121710
+
+ Reviewed by Filip Pizlo.
+
+ Don't claim to be able to rely on the arguments structure, use the Arguments
+ speculation type
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::::executeEffects):
+
2013-09-20 Mark Hahnenberg <[email protected]>
Clobberize phase forgets to indicate that it writes GCState for several node types
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (156210 => 156211)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2013-09-20 23:59:19 UTC (rev 156210)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2013-09-21 00:00:30 UTC (rev 156211)
@@ -1120,11 +1120,9 @@
m_graph, m_codeBlock->globalObjectFor(node->codeOrigin)->activationStructure());
m_state.setHaveStructures(true);
break;
-
+
case CreateArguments:
- forNode(node).set(
- m_graph, m_codeBlock->globalObjectFor(node->codeOrigin)->argumentsStructure());
- m_state.setHaveStructures(true);
+ forNode(node).setType(SpecArguments);
break;
case TearOffActivation:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
