Changeset 228457 in webkit

Timestamp:

Feb 13, 2018 10:05:25 PM (6 years ago)

Author:

jmarcell@apple.com

Message:

Cherry-pick r228401. rdar://problem/37521078

Location:

branches/safari-605-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/get-array-length-phantom-new-array-buffer.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp (modified) (1 diff)

branches/safari-605-branch/JSTests/ChangeLog

@@ +1 @@
+2018-02-13  Jason Marcell  <jmarcell@apple.com>
+
+        Cherry-pick r228401. rdar://problem/37521078
+
+    2018-02-12  Saam Barati  <sbarati@apple.com>
+
+            DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
+            https://bugs.webkit.org/show_bug.cgi?id=182706
+            <rdar://problem/36833681>
+
+            Reviewed by Filip Pizlo.
+
+            * stress/get-array-length-phantom-new-array-buffer.js: Added.
+            (effects):
+            (foo):
+
 2018-02-06  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-605-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-02-13  Jason Marcell  <jmarcell@apple.com>
+
+        Cherry-pick r228401. rdar://problem/37521078
+
+    2018-02-12  Saam Barati  <sbarati@apple.com>
+
+            DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
+            https://bugs.webkit.org/show_bug.cgi?id=182706
+            <rdar://problem/36833681>
+
+            Reviewed by Filip Pizlo.
+
+            When we added support for PhantomNewArrayBuffer, we forgot to update
+            the emitCodeToGetArgumentsArrayLength function to handle PhantomNewArrayBuffer.
+            This patch adds that support. It's trivial to generate the length for
+            a PhantomNewArrayBuffer node since it's a constant buffer, with a constant
+            length.
+
+            * dfg/DFGArgumentsUtilities.cpp:
+            (JSC::DFG::emitCodeToGetArgumentsArrayLength):
+
 2018-02-06  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-605-branch/Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp

@@ -66 +66 @@
         graph, arguments,
         arguments->op() == CreateDirectArguments || arguments->op() == CreateScopedArguments
-        || arguments->op() == CreateClonedArguments || arguments->op() == CreateRest
-        || arguments->op() == PhantomDirectArguments || arguments->op() == PhantomClonedArguments || arguments->op() == PhantomCreateRest,
+        || arguments->op() == CreateClonedArguments || arguments->op() == CreateRest || arguments->op() == NewArrayBuffer
+        || arguments->op() == PhantomDirectArguments || arguments->op() == PhantomClonedArguments
+        || arguments->op() == PhantomCreateRest || arguments->op() == PhantomNewArrayBuffer,
         arguments->op());
+
+    if (arguments->op() == NewArrayBuffer || arguments->op() == PhantomNewArrayBuffer) {
+        return insertionSet.insertConstant(
+            nodeIndex, origin, jsNumber(arguments->castOperand<JSFixedArray*>()->length()));
+    }
     
     InlineCallFrame* inlineCallFrame = arguments->origin.semantic.inlineCallFrame;