Changeset 155730 in webkit


Ignore:
Timestamp:
Sep 13, 2013, 4:18:19 PM (11 years ago)
Author:
fpizlo@apple.com
Message:

DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
​https://bugs.webkit.org/show_bug.cgi?id=121330

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg and Oliver Hunt.

Also print whether a function is strict mode in debug dumps.

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpAssumingJITType):

  • bytecode/CodeOrigin.cpp:

(JSC::InlineCallFrame::dumpInContext):

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::::executeEffects):

  • dfg/DFGOperations.cpp:
  • dfg/DFGOperations.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Tools:

Reviewed by Mark Hahnenberg and Oliver Hunt.

We should run tests even if they don't have expected files yet.

  • Scripts/run-layout-jsc:

LayoutTests:

Reviewed by Mark Hahnenberg and Oliver Hunt.

  • js/dfg-strict-mode-to-this-expected.txt: Added.
  • js/dfg-strict-mode-to-this.html: Added.
  • js/jsc-test-list:
  • js/script-tests/dfg-strict-mode-to-this.js: Added.

(thingy.bar):
(thingy.foo):
(thingy):

Location:
trunk
Files:
3 added
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r155728 r155730  
     12013-09-13  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
     4        https://bugs.webkit.org/show_bug.cgi?id=121330
     5
     6        Reviewed by Mark Hahnenberg and Oliver Hunt.
     7
     8        * js/dfg-strict-mode-to-this-expected.txt: Added.
     9        * js/dfg-strict-mode-to-this.html: Added.
     10        * js/jsc-test-list:
     11        * js/script-tests/dfg-strict-mode-to-this.js: Added.
     12        (thingy.bar):
     13        (thingy.foo):
     14        (thingy):
     15
    1162013-09-13  Alexey Proskuryakov  <ap@apple.com>
    217

  • trunk/LayoutTests/js/jsc-test-list

    r155452 r155730  
    226226js/dfg-side-effect-assignment-osr-exit
    227227js/dfg-sqrt-backwards-propagation
     228js/dfg-strict-mode-to-this
    228229js/dfg-string-out-of-bounds-check-structure
    229230js/dfg-string-out-of-bounds-cse

  • trunk/Source/JavaScriptCore/ChangeLog

    r155729 r155730  
     12013-09-13  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
     4        https://bugs.webkit.org/show_bug.cgi?id=121330
     5
     6        Reviewed by Mark Hahnenberg and Oliver Hunt.
     7       
     8        Also print whether a function is strict mode in debug dumps.
     9
     10        * bytecode/CodeBlock.cpp:
     11        (JSC::CodeBlock::dumpAssumingJITType):
     12        * bytecode/CodeOrigin.cpp:
     13        (JSC::InlineCallFrame::dumpInContext):
     14        * dfg/DFGAbstractInterpreterInlines.h:
     15        (JSC::DFG::::executeEffects):
     16        * dfg/DFGOperations.cpp:
     17        * dfg/DFGOperations.h:
     18        * dfg/DFGSpeculativeJIT32_64.cpp:
     19        (JSC::DFG::SpeculativeJIT::compile):
     20        * dfg/DFGSpeculativeJIT64.cpp:
     21        (JSC::DFG::SpeculativeJIT::compile):
     22
    1232013-09-13  Anders Carlsson  <andersca@apple.com>
    224

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r155711 r155730  
    140140    if (ownerExecutable()->neverInline())
    141141        out.print(" (NeverInline)");
     142    if (ownerExecutable()->isStrictMode())
     143        out.print(" (StrictMode)");
    142144    out.print("]");
    143145}

  • trunk/Source/JavaScriptCore/bytecode/CodeOrigin.cpp

    r154935 r155730  
    111111void InlineCallFrame::dumpInContext(PrintStream& out, DumpContext* context) const
    112112{
    113     out.print(briefFunctionInformation(), ":<", RawPointer(executable.get()), ", bc#", caller.bytecodeIndex, ", ", specializationKind());
     113    out.print(briefFunctionInformation(), ":<", RawPointer(executable.get()));
     114    if (executable->isStrictMode())
     115        out.print(" (StrictMode)");
     116    out.print(", bc#", caller.bytecodeIndex, ", ", specializationKind());
    114117    if (callee)
    115118        out.print(", known callee: ", inContext(JSValue(callee.get()), context));

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r155567 r155730  
    10451045        AbstractValue& destination = forNode(node);
    10461046           
    1047         destination = source;
    1048         destination.merge(SpecObject);
     1047        if (m_graph.executableFor(node->codeOrigin)->isStrictMode())
     1048            destination.makeHeapTop();
     1049        else {
     1050            destination = source;
     1051            destination.merge(SpecObject);
     1052        }
    10491053        break;
    10501054    }

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r155711 r155730  
    472472    NativeCallFrameTracer tracer(vm, exec);
    473473
    474     return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
     474    return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, NotStrictMode));
     475}
     476
     477EncodedJSValue DFG_OPERATION operationToThisStrict(ExecState* exec, EncodedJSValue encodedOp)
     478{
     479    VM* vm = &exec->vm();
     480    NativeCallFrameTracer tracer(vm, exec);
     481
     482    return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, StrictMode));
    475483}
    476484

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r155243 r155730  
    137137JSCell* DFG_OPERATION operationCreateThis(ExecState*, JSObject* constructor, int32_t inlineCapacity) WTF_INTERNAL;
    138138EncodedJSValue DFG_OPERATION operationToThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
     139EncodedJSValue DFG_OPERATION operationToThisStrict(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
    139140EncodedJSValue DFG_OPERATION operationValueAdd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
    140141EncodedJSValue DFG_OPERATION operationValueAddNotNumber(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r155711 r155730  
    36123612        m_jit.move(thisValuePayloadGPR, tempGPR);
    36133613        m_jit.move(thisValueTagGPR, tempTagGPR);
     3614        J_DFGOperation_EJ function;
     3615        if (m_jit.graph().executableFor(node->codeOrigin)->isStrictMode())
     3616            function = operationToThisStrict;
     3617        else
     3618            function = operationToThis;
    36143619        addSlowPathGenerator(
    36153620            slowPathCall(
    3616                 slowCases, this, operationToThis,
     3621                slowCases, this, function,
    36173622                JSValueRegs(tempTagGPR, tempGPR), thisValueTagGPR, thisValuePayloadGPR));
    36183623

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r155711 r155730  
    35163516            TrustedImm32(FinalObjectType)));
    35173517        m_jit.move(thisValueGPR, tempGPR);
     3518        J_DFGOperation_EJ function;
     3519        if (m_jit.graph().executableFor(node->codeOrigin)->isStrictMode())
     3520            function = operationToThisStrict;
     3521        else
     3522            function = operationToThis;
    35183523        addSlowPathGenerator(
    3519             slowPathCall(slowCases, this, operationToThis, tempGPR, thisValueGPR));
     3524            slowPathCall(slowCases, this, function, tempGPR, thisValueGPR));
    35203525
    35213526        jsValueResult(tempGPR, node);

  • trunk/Tools/ChangeLog

    r155729 r155730  
     12013-09-13  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
     4        https://bugs.webkit.org/show_bug.cgi?id=121330
     5
     6        Reviewed by Mark Hahnenberg and Oliver Hunt.
     7
     8        We should run tests even if they don't have expected files yet.
     9       
     10        * Scripts/run-layout-jsc:
     11
    1122013-09-13  Anders Carlsson  <andersca@apple.com>
    213

  • trunk/Tools/Scripts/run-layout-jsc

    r155479 r155730  
    107107    fi
    108108
    109     if [ -f $expectedOut -a -f $jsTest ]
     109    if [ -f $jsTest ]
    110110    then
    111111        if [ `uname` = 'Darwin' ]; then
Note: See TracChangeset for help on using the changeset viewer.