Changeset 259264 in webkit

Timestamp:

Mar 30, 2020, 6:46:55 PM (6 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] DFGArrayMode::alreadyChecked should have NonArray check when ArrayMode is NonArray+SlowPutArrayStorage
​https://bugs.webkit.org/show_bug.cgi?id=209791

Reviewed by Saam Barati.

DFGArrayMode::alreadyChecked with NonArray+SlowPutArrayStorage should check NonArray condition.

• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::alreadyChecked const):

• dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::arrayModesWithIndexingShapes const):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGArrayMode.cpp (modified) (3 diffs)
• dfg/DFGArrayMode.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-03-30  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] DFGArrayMode::alreadyChecked should have NonArray check when ArrayMode is NonArray+SlowPutArrayStorage
+        https://bugs.webkit.org/show_bug.cgi?id=209791
+
+        Reviewed by Saam Barati.
+
+        DFGArrayMode::alreadyChecked with NonArray+SlowPutArrayStorage should check NonArray condition.
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::alreadyChecked const):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShapes const):
+
 2020-03-30  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

@@ -512 +512 @@
     case Array::SlowPutArrayStorage:
         switch (arrayClass()) {
-        case Array::OriginalArray: {
+        case Array::OriginalArray:
+        case Array::OriginalCopyOnWriteArray: {
             CRASH();
             return false;
@@ -531 +532 @@
             return true;
         }
-        
-        default: {
+
+        // Array::OriginalNonArray can be shown when the value is a TypedArray with original structure.
+        // But here, we already filtered TypedArrays. So, just handle it like a NonArray.
+        case Array::NonArray:
+        case Array::OriginalNonArray: {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage)))
+                return true;
+            if (value.m_structure.isTop())
+                return false;
+            for (unsigned i = value.m_structure.size(); i--;) {
+                RegisteredStructure structure = value.m_structure[i];
+                if (!hasAnyArrayStorage(structure->indexingType()))
+                    return false;
+                if (structure->indexingType() & IsArray)
+                    return false;
+            }
+            return true;
+        }
+
+        case Array::PossiblyArray: {
             if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage)))
                 return true;
@@ -543 +562 @@
             }
             return true;
-        } }
+        }
+        }
         
     case Array::DirectArguments:

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

@@ -532 +532 @@
                 return asArrayModesIgnoringTypedArrays(shape) | asArrayModesIgnoringTypedArrays(shape | IsArray) | asArrayModesIgnoringTypedArrays(shape | IsArray | CopyOnWrite);
             return asArrayModesIgnoringTypedArrays(shape) | asArrayModesIgnoringTypedArrays(shape | IsArray);
-        default:
-            // This is only necessary for C++ compilers that don't understand enums.
-            return 0;
-        }
+        }
+        // This is only necessary for C++ compilers that don't understand enums.
+        return 0;
     }