Changeset 284716 in webkit

Timestamp:

Oct 22, 2021, 2:56:00 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] GetTypedArrayLengthAsInt52 must be inserted only when we ensure that input is TypedArray via array-mode-based filtering
​https://bugs.webkit.org/show_bug.cgi?id=232168
rdar://84366658

Reviewed by Robin Morisset.

JSTests:

• stress/gettypedarraylengthasint52-must-be-emitted-for-typedarray.js: Added.

(foo):

Source/JavaScriptCore:

GetTypedArrayLengthAsInt52 works only when input is TypedArray, which should be validated via array-mode (and already inserted checks in fixup).
Accidentally we were inserting it without checking typed-array condition in SSA lowering phase. This patch adds a condition which ensures it
is TypedArray.

• dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::SSALoweringPhase::handleNode):
(JSC::DFG::SSALoweringPhase::lowerBoundsCheck):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/gettypedarraylengthasint52-must-be-emitted-for-typedarray.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSSALoweringPhase.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-10-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] GetTypedArrayLengthAsInt52 must be inserted only when we ensure that input is TypedArray via array-mode-based filtering
+        https://bugs.webkit.org/show_bug.cgi?id=232168
+        rdar://84366658
+
+        Reviewed by Robin Morisset.
+
+        * stress/gettypedarraylengthasint52-must-be-emitted-for-typedarray.js: Added.
+        (foo):
+
 2021-10-22  Asumu Takikawa  <asumu@igalia.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] GetTypedArrayLengthAsInt52 must be inserted only when we ensure that input is TypedArray via array-mode-based filtering
+        https://bugs.webkit.org/show_bug.cgi?id=232168
+        rdar://84366658
+
+        Reviewed by Robin Morisset.
+
+        GetTypedArrayLengthAsInt52 works only when input is TypedArray, which should be validated via array-mode (and already inserted checks in fixup).
+        Accidentally we were inserting it without checking typed-array condition in SSA lowering phase. This patch adds a condition which ensures it
+        is TypedArray.
+
+        * dfg/DFGSSALoweringPhase.cpp:
+        (JSC::DFG::SSALoweringPhase::handleNode):
+        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
+
 2021-10-22  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSSALoweringPhase.cpp

@@ -100 +100 @@
                 break;
             
-            if (m_node->arrayMode().typedArrayType() != NotTypedArray && m_node->arrayMode().isOutOfBounds()) {
+            if (m_node->arrayMode().isSomeTypedArrayView() && m_node->arrayMode().isOutOfBounds()) {
 #if USE(LARGE_TYPED_ARRAYS)
                 if (m_node->arrayMode().mayBeLargeTypedArray() || m_graph.hasExitSite(m_node->origin.semantic, Overflow)) {
@@ -150 +150 @@
         Node* checkInBounds;
 #if USE(LARGE_TYPED_ARRAYS)
-        if ((op == GetArrayLength) && (m_node->arrayMode().mayBeLargeTypedArray() || m_graph.hasExitSite(m_node->origin.semantic, Overflow))) {
+        if ((op == GetArrayLength) && m_node->arrayMode().isSomeTypedArrayView() && (m_node->arrayMode().mayBeLargeTypedArray() || m_graph.hasExitSite(m_node->origin.semantic, Overflow))) {
             Node* length = m_insertionSet.insertNode(
                 m_nodeIndex, SpecInt52Any, GetTypedArrayLengthAsInt52, m_node->origin,