Changeset 199935 in webkit


Ignore:
Timestamp:
Apr 22, 2016, 4:48:44 PM (9 years ago)
Author:
mark.lam@apple.com
Message:

javascript jit bug affecting Google Maps.
​https://bugs.webkit.org/show_bug.cgi?id=153431

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

The issue was due to the abstract interpreter wrongly marking the type of the
value read from the Uint3Array as SpecInt52, which precludes it from being an
Int32. This proves to be false, and the generated code failed to handle the case
where the read value is actually an Int32.

The fix is to have the abstract interpreter use SpecMachineInt instead of
SpecInt52.

  • bytecode/SpeculatedType.h:
  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

LayoutTests:

  • js/regress/bug-153431-expected.txt: Added.
  • js/regress/bug-153431.html: Added.
  • js/regress/script-tests/bug-153431.js: Added.
Location:
trunk
Files:
3 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r199927 r199935  
     12016-04-22  Mark Lam  <mark.lam@apple.com>
     2
     3        javascript jit bug affecting Google Maps.
     4        https://bugs.webkit.org/show_bug.cgi?id=153431
     5
     6        Reviewed by Filip Pizlo.
     7
     8        * js/regress/bug-153431-expected.txt: Added.
     9        * js/regress/bug-153431.html: Added.
     10        * js/regress/script-tests/bug-153431.js: Added.
     11
    1122016-04-22  Geoffrey Garen  <ggaren@apple.com>
    213

  • trunk/Source/JavaScriptCore/ChangeLog

    r199933 r199935  
     12016-04-22  Mark Lam  <mark.lam@apple.com>
     2
     3        javascript jit bug affecting Google Maps.
     4        https://bugs.webkit.org/show_bug.cgi?id=153431
     5
     6        Reviewed by Filip Pizlo.
     7
     8        The issue was due to the abstract interpreter wrongly marking the type of the
     9        value read from the Uint3Array as SpecInt52, which precludes it from being an
     10        Int32.  This proves to be false, and the generated code failed to handle the case
     11        where the read value is actually an Int32.
     12
     13        The fix is to have the abstract interpreter use SpecMachineInt instead of
     14        SpecInt52.
     15
     16        * bytecode/SpeculatedType.h:
     17        * dfg/DFGAbstractInterpreterInlines.h:
     18        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
     19
    1202016-04-22  Benjamin Poulain  <bpoulain@apple.com>
    221

  • trunk/Source/JavaScriptCore/bytecode/SpeculatedType.h

    r197649 r199935  
    6868static const SpeculatedType SpecNonBoolInt32       = 1u << 22; // It's definitely an Int32 with value other than 0 or 1.
    6969static const SpeculatedType SpecInt32              = SpecBoolInt32 | SpecNonBoolInt32; // It's definitely an Int32.
    70 static const SpeculatedType SpecInt52              = 1u << 23; // It's definitely an Int52 and we intend it to unbox it.
     70static const SpeculatedType SpecInt52              = 1u << 23; // It's definitely an Int52 and we intend it to unbox it. It's also definitely not an Int32.
    7171static const SpeculatedType SpecMachineInt         = SpecInt32 | SpecInt52; // It's something that we can do machine int arithmetic on.
    7272static const SpeculatedType SpecInt52AsDouble      = 1u << 24; // It's definitely an Int52 and it's inside a double.

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r199867 r199935  
    15631563                forNode(node).setType(SpecInt32);
    15641564            else if (enableInt52() && node->shouldSpeculateMachineInt())
    1565                 forNode(node).setType(SpecInt52);
     1565                forNode(node).setType(SpecMachineInt);
    15661566            else
    15671567                forNode(node).setType(SpecInt52AsDouble);
Note: See TracChangeset for help on using the changeset viewer.