Changeset 196323 in webkit

Timestamp:

Feb 9, 2016, 12:18:31 PM (11 years ago)

Author:

fpizlo@apple.com

Message:

Spread expressions are not fair game for direct binding
​https://bugs.webkit.org/show_bug.cgi?id=154042
rdar://problem/24291413

Reviewed by Saam Barati.

Prior to this change we crashed on this:

var [x] = [...y];

Because NodesCodegen thinks that this is a direct binding. It's not, because we cannot
directly generate bytecode for "...y". This is a unique property of spread expressions, so
its sufficient to just bail out of direct binding if we see a spread expression. That's what
this patch does.

• bytecompiler/NodesCodegen.cpp:

(JSC::ArrayPatternNode::emitDirectBinding):

• tests/stress/spread-in-tail.js: Added.

(foo):
(catch):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (2 diffs)
• bytecompiler/NodesCodegen.cpp (modified) (1 diff)
• tests/stress/spread-in-tail.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Spread expressions are not fair game for direct binding
+        https://bugs.webkit.org/show_bug.cgi?id=154042
+        rdar://problem/24291413
+
+        Reviewed by Saam Barati.
+
+        Prior to this change we crashed on this:
+
+            var [x] = [...y];
+
+        Because NodesCodegen thinks that this is a direct binding.  It's not, because we cannot
+        directly generate bytecode for "...y".  This is a unique property of spread expressions, so
+        its sufficient to just bail out of direct binding if we see a spread expression. That's what
+        this patch does.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        * tests/stress/spread-in-tail.js: Added.
+        (foo):
+        (catch):
+
 2016-02-09  Commit Queue  <commit-queue@webkit.org>
 
@@ -39 +62 @@
         runtimeTypeForValue should protect against seeing TDZ value
         https://bugs.webkit.org/show_bug.cgi?id=154023
+        rdar://problem/24291413
 
         Reviewed by Michael Saboff.

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -3432 +3432 @@
 {
     if (!rhs->isSimpleArray())
-        return 0;
+        return nullptr;
+
+    ElementNode* elementNodes = static_cast<ArrayNode*>(rhs)->elements();
+    Vector<ExpressionNode*> elements;
+    for (; elementNodes; elementNodes = elementNodes->next()) {
+        ExpressionNode* value = elementNodes->value();
+        if (value->isSpreadExpression())
+            return nullptr;
+        elements.append(value);
+    }
 
     RefPtr<RegisterID> resultRegister;
     if (dst && dst != generator.ignoredResult())
         resultRegister = generator.emitNewArray(generator.newTemporary(), 0, 0);
-    ElementNode* elementNodes = static_cast<ArrayNode*>(rhs)->elements();
-    Vector<ExpressionNode*> elements;
-    for (; elementNodes; elementNodes = elementNodes->next())
-        elements.append(elementNodes->value());
     if (m_targetPatterns.size() != elements.size())
-        return 0;
+        return nullptr;
     Vector<RefPtr<RegisterID>> registers;
     registers.reserveCapacity(m_targetPatterns.size());