Changeset 259598 in webkit

Timestamp:

Apr 6, 2020, 3:47:10 PM (6 years ago)

Author:

Alan Coon

Message:

Cherry-pick r259264. rdar://problem/61352437

[JSC] DFGArrayMode::alreadyChecked should have NonArray check when ArrayMode is NonArray+SlowPutArrayStorage
​https://bugs.webkit.org/show_bug.cgi?id=209791

Reviewed by Saam Barati.

DFGArrayMode::alreadyChecked with NonArray+SlowPutArrayStorage should check NonArray condition.

• dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::alreadyChecked const):
• dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::arrayModesWithIndexingShapes const):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@259264 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-609.2.1.2-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGArrayMode.cpp (modified) (3 diffs)
• dfg/DFGArrayMode.h (modified) (1 diff)

branches/safari-609.2.1.2-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-06  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r259264. rdar://problem/61352437
+
+    [JSC] DFGArrayMode::alreadyChecked should have NonArray check when ArrayMode is NonArray+SlowPutArrayStorage
+    https://bugs.webkit.org/show_bug.cgi?id=209791
+    
+    Reviewed by Saam Barati.
+    
+    DFGArrayMode::alreadyChecked with NonArray+SlowPutArrayStorage should check NonArray condition.
+    
+    * dfg/DFGArrayMode.cpp:
+    (JSC::DFG::ArrayMode::alreadyChecked const):
+    * dfg/DFGArrayMode.h:
+    (JSC::DFG::ArrayMode::arrayModesWithIndexingShapes const):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@259264 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-03-30  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] DFGArrayMode::alreadyChecked should have NonArray check when ArrayMode is NonArray+SlowPutArrayStorage
+            https://bugs.webkit.org/show_bug.cgi?id=209791
+
+            Reviewed by Saam Barati.
+
+            DFGArrayMode::alreadyChecked with NonArray+SlowPutArrayStorage should check NonArray condition.
+
+            * dfg/DFGArrayMode.cpp:
+            (JSC::DFG::ArrayMode::alreadyChecked const):
+            * dfg/DFGArrayMode.h:
+            (JSC::DFG::ArrayMode::arrayModesWithIndexingShapes const):
+
 2020-04-03  Alan Coon  <alancoon@apple.com>
 

branches/safari-609.2.1.2-branch/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

@@ -511 +511 @@
     case Array::SlowPutArrayStorage:
         switch (arrayClass()) {
-        case Array::OriginalArray: {
+        case Array::OriginalArray:
+        case Array::OriginalCopyOnWriteArray: {
             CRASH();
             return false;
@@ -530 +531 @@
             return true;
         }
-        
-        default: {
+
+        // Array::OriginalNonArray can be shown when the value is a TypedArray with original structure.
+        // But here, we already filtered TypedArrays. So, just handle it like a NonArray.
+        case Array::NonArray:
+        case Array::OriginalNonArray: {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage)))
+                return true;
+            if (value.m_structure.isTop())
+                return false;
+            for (unsigned i = value.m_structure.size(); i--;) {
+                RegisteredStructure structure = value.m_structure[i];
+                if (!hasAnyArrayStorage(structure->indexingType()))
+                    return false;
+                if (structure->indexingType() & IsArray)
+                    return false;
+            }
+            return true;
+        }
+
+        case Array::PossiblyArray: {
             if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage)))
                 return true;
@@ -542 +561 @@
             }
             return true;
-        } }
+        }
+        }
         
     case Array::DirectArguments:

branches/safari-609.2.1.2-branch/Source/JavaScriptCore/dfg/DFGArrayMode.h

@@ -532 +532 @@
                 return asArrayModesIgnoringTypedArrays(shape) | asArrayModesIgnoringTypedArrays(shape | IsArray) | asArrayModesIgnoringTypedArrays(shape | IsArray | CopyOnWrite);
             return asArrayModesIgnoringTypedArrays(shape) | asArrayModesIgnoringTypedArrays(shape | IsArray);
-        default:
-            // This is only necessary for C++ compilers that don't understand enums.
-            return 0;
-        }
+        }
+        // This is only necessary for C++ compilers that don't understand enums.
+        return 0;
     }