Changeset 259681 in webkit

Timestamp:

Apr 7, 2020, 4:11:21 PM (6 years ago)

Author:

sbarati@apple.com

Message:

Delete ICs can't cache dictionaries
​https://bugs.webkit.org/show_bug.cgi?id=210147
<rdar://problem/61382405>

Reviewed by Tadeu Zagallo.

JSTests:

• stress/dont-cache-delete-ic-on-dictionary-2.js: Added.

(assert):
(makeDictionary):
(foo):

• stress/dont-cache-delete-ic-on-dictionary.js: Added.

(assert):
(foo):

Source/JavaScriptCore:

We were happily caching delete IC cases on a dictionary object.
This is clearly wrong, as we might cache a miss on a dictionary
on a property "P", even though we might add "P" to the structure
without transitioning it.

• jit/Repatch.cpp:

(JSC::tryCacheDeleteBy):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/dont-cache-delete-ic-on-dictionary-2.js (added)
• JSTests/stress/dont-cache-delete-ic-on-dictionary.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jit/Repatch.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-04-07  Saam Barati  <sbarati@apple.com>
+
+        Delete ICs can't cache dictionaries
+        https://bugs.webkit.org/show_bug.cgi?id=210147
+        <rdar://problem/61382405>
+
+        Reviewed by Tadeu Zagallo.
+
+        * stress/dont-cache-delete-ic-on-dictionary-2.js: Added.
+        (assert):
+        (makeDictionary):
+        (foo):
+        * stress/dont-cache-delete-ic-on-dictionary.js: Added.
+        (assert):
+        (foo):
+
 2020-04-07  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-07  Saam Barati  <sbarati@apple.com>
+
+        Delete ICs can't cache dictionaries
+        https://bugs.webkit.org/show_bug.cgi?id=210147
+        <rdar://problem/61382405>
+
+        Reviewed by Tadeu Zagallo.
+
+        We were happily caching delete IC cases on a dictionary object.
+        This is clearly wrong, as we might cache a miss on a dictionary
+        on a property "P", even though we might add "P" to the structure
+        without transitioning it.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheDeleteBy):
+
 2020-04-07  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/JavaScriptCore/jit/Repatch.cpp

@@ -757 +757 @@
             return GiveUpOnCache;
 
+        if (baseValue.asCell()->structure()->isDictionary()) {
+            if (baseValue.asCell()->structure()->hasBeenFlattenedBefore())
+                return GiveUpOnCache;
+            jsCast<JSObject*>(baseValue)->flattenDictionaryObject(vm);
+            return RetryCacheLater;
+        }
+
+        if (oldStructure->isDictionary())
+            return RetryCacheLater;
+
         std::unique_ptr<AccessCase> newCase;