Changeset 245443 in webkit

Timestamp:

May 17, 2019, 3:14:58 AM (7 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r244314 - SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
​https://bugs.webkit.org/show_bug.cgi?id=196945
<rdar://problem/49802750>

Reviewed by Filip Pizlo.

JSTests:

• stress/get-by-offset-should-use-correct-child.js: Added.

(foo.bar):
(foo):

Source/JavaScriptCore:

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

Location:

releases/WebKitGTK/webkit-2.24

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/get-by-offset-should-use-correct-child.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSafeToExecute.h (modified) (2 diffs)

releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog

@@ +1 @@
+2019-04-15  Saam barati  <sbarati@apple.com>
+
+        SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+        https://bugs.webkit.org/show_bug.cgi?id=196945
+        <rdar://problem/49802750>
+
+        Reviewed by Filip Pizlo.
+
+        * stress/get-by-offset-should-use-correct-child.js: Added.
+        (foo.bar):
+        (foo):
+
 2019-03-12  Michael Saboff  <msaboff@apple.com>
 

releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-04-15  Saam barati  <sbarati@apple.com>
+
+        SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+        https://bugs.webkit.org/show_bug.cgi?id=196945
+        <rdar://problem/49802750>
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+
 2019-04-03  Myles C. Maxfield  <mmaxfield@apple.com>
 

releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

@@ -545 +545 @@
         // structure that has a type proof, then the next case below will deal with it.
         if (state.structureClobberState() == StructuresAreWatched) {
-            if (JSObject* knownBase = node->child1()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
+            if (JSObject* knownBase = node->child2()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
                 if (graph.isSafeToLoad(knownBase, offset))
                     return true;
@@ -551 +551 @@
         }
         
-        StructureAbstractValue& value = state.forNode(node->child1()).m_structure;
+        StructureAbstractValue& value = state.forNode(node->child2()).m_structure;
         if (value.isInfinite())
             return false;