Changeset 280716 in webkit

Timestamp:

Aug 5, 2021, 6:59:40 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Assertion failure when checking array in DFG (32 bits)
​https://bugs.webkit.org/show_bug.cgi?id=228839

Patch by Mikhail R. Gadelha <Mikhail R. Gadelha> on 2021-08-05
Reviewed by Yusuke Suzuki.

JSTests:

• stress/check-array-empty-32.js: Added.

(a.b.catch.print.c):
(a.b):
(a.e):
(a):

Source/JavaScriptCore:

Since empty values don't pass the cell check in 32 bits, we need to
guard the SpecEmpty check to only happen in 64 bits archs

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::checkArray):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/check-array-empty-32.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-08-05  Mikhail R. Gadelha  <mikhail@igalia.com>
+
+        Assertion failure when checking array in DFG (32 bits)
+        https://bugs.webkit.org/show_bug.cgi?id=228839
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/check-array-empty-32.js: Added.
+        (a.b.catch.print.c):
+        (a.b):
+        (a.e):
+        (a):
+
 2021-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-08-05  Mikhail R. Gadelha  <mikhail@igalia.com>
+
+        Assertion failure when checking array in DFG (32 bits)
+        https://bugs.webkit.org/show_bug.cgi?id=228839
+
+        Reviewed by Yusuke Suzuki.
+
+        Since empty values don't pass the cell check in 32 bits, we need to
+        guard the SpecEmpty check to only happen in 64 bits archs
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+
 2021-08-05  Robin Morisset  <rmorisset@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -859 +859 @@
     if (arrayMode.alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1()))) {
         // We can purge Empty check completely in this case of CheckArrayOrEmpty since CellUse only accepts SpecCell | SpecEmpty.
+#if USE(JSVALUE64)
         ASSERT(typeFilterFor(node->child1().useKind()) & SpecEmpty);
+#endif
         noResult(m_currentNode);
         return;