Changeset 245349 in webkit

Timestamp:

May 15, 2019, 2:44:46 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r244314. rdar://problem/50753930

SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
​https://bugs.webkit.org/show_bug.cgi?id=196945
<rdar://problem/49802750>

Reviewed by Filip Pizlo.

JSTests:

• stress/get-by-offset-should-use-correct-child.js: Added. (foo.bar): (foo):

Source/JavaScriptCore:

• dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@244314 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/get-by-offset-should-use-correct-child.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSafeToExecute.h (modified) (2 diffs)

branches/safari-607-branch/JSTests/ChangeLog

@@ +1 @@
+2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r244314. rdar://problem/50753930
+
+    SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+    https://bugs.webkit.org/show_bug.cgi?id=196945
+    <rdar://problem/49802750>
+    
+    Reviewed by Filip Pizlo.
+    
+    JSTests:
+    
+    * stress/get-by-offset-should-use-correct-child.js: Added.
+    (foo.bar):
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    * dfg/DFGSafeToExecute.h:
+    (JSC::DFG::safeToExecute):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244314 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-04-15  Saam barati  <sbarati@apple.com>
+
+            SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+            https://bugs.webkit.org/show_bug.cgi?id=196945
+            <rdar://problem/49802750>
+
+            Reviewed by Filip Pizlo.
+
+            * stress/get-by-offset-should-use-correct-child.js: Added.
+            (foo.bar):
+            (foo):
+
 2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r244314. rdar://problem/50753930
+
+    SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+    https://bugs.webkit.org/show_bug.cgi?id=196945
+    <rdar://problem/49802750>
+    
+    Reviewed by Filip Pizlo.
+    
+    JSTests:
+    
+    * stress/get-by-offset-should-use-correct-child.js: Added.
+    (foo.bar):
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    * dfg/DFGSafeToExecute.h:
+    (JSC::DFG::safeToExecute):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244314 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-04-15  Saam barati  <sbarati@apple.com>
+
+            SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+            https://bugs.webkit.org/show_bug.cgi?id=196945
+            <rdar://problem/49802750>
+
+            Reviewed by Filip Pizlo.
+
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+
 2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

@@ -544 +544 @@
         // structure that has a type proof, then the next case below will deal with it.
         if (state.structureClobberState() == StructuresAreWatched) {
-            if (JSObject* knownBase = node->child1()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
+            if (JSObject* knownBase = node->child2()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
                 if (graph.isSafeToLoad(knownBase, offset))
                     return true;
@@ -550 +550 @@
         }
         
-        StructureAbstractValue& value = state.forNode(node->child1()).m_structure;
+        StructureAbstractValue& value = state.forNode(node->child2()).m_structure;
         if (value.isInfinite())
             return false;