Changeset 285592 in webkit

Timestamp:

Nov 10, 2021, 10:54:59 AM (5 years ago)

Author:

sbarati@apple.com

Message:

in_by_val should not constant fold to in_by_id when the property is a property index
​https://bugs.webkit.org/show_bug.cgi?id=232753

Reviewed by Yusuke Suzuki.

JSTests:

• stress/dont-in-by-id-when-index-2.js: Added.

(assert):
(main.v179):
(main.async v244):
(main):

• stress/dont-in-by-id-when-index.js: Added.

(assert):
(test):

Source/JavaScriptCore:

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGValidate.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/dont-in-by-id-when-index-2.js (added)
• JSTests/stress/dont-in-by-id-when-index.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGValidate.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-11-10  Saam Barati  <sbarati@apple.com>
+
+        in_by_val should not constant fold to in_by_id when the property is a property index
+        https://bugs.webkit.org/show_bug.cgi?id=232753
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/dont-in-by-id-when-index-2.js: Added.
+        (assert):
+        (main.v179):
+        (main.async v244):
+        (main):
+        * stress/dont-in-by-id-when-index.js: Added.
+        (assert):
+        (test):
+
 2021-11-10  Xan Lopez  <xan@igalia.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-11-10  Saam Barati  <sbarati@apple.com>
+
+        in_by_val should not constant fold to in_by_id when the property is a property index
+        https://bugs.webkit.org/show_bug.cgi?id=232753
+
+        Reviewed by Yusuke Suzuki.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGValidate.cpp:
+
 2021-11-09  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -4249 +4249 @@
             if (constant.isString()) {
                 JSString* string = asString(constant);
-                if (CacheableIdentifier::isCacheableIdentifierCell(string))
+                if (CacheableIdentifier::isCacheableIdentifierCell(string) && !parseIndex(CacheableIdentifier::createFromCell(string).uid()))
                     m_state.setShouldTryConstantFolding(true);
             }

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -682 +682 @@
                     if (constant.isString()) {
                         JSString* string = asString(constant);
-                        if (CacheableIdentifier::isCacheableIdentifierCell(string)) {
+                        if (CacheableIdentifier::isCacheableIdentifierCell(string) && !parseIndex(CacheableIdentifier::createFromCell(string).uid())) {
                             const StringImpl* impl = string->tryGetValueImpl();
                             RELEASE_ASSERT(impl);

trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp

@@ -30 +30 @@
 
 #include "ButterflyInlines.h"
+#include "CacheableIdentifierInlines.h"
 #include "DFGClobberize.h"
 #include "DFGClobbersExitState.h"
@@ -234 +235 @@
                     if (!node->child1())
                         VALIDATE((node), !node->child2());
+                }
+
+                if (node->hasCacheableIdentifier()) {
+                    auto* uid = node->cacheableIdentifier().uid();
+                    VALIDATE((node), !parseIndex(*uid));
                 }