Changeset 224735 in webkit


Ignore:
Timestamp:
Nov 12, 2017 7:34:23 AM (6 years ago)
Author:
mark.lam@apple.com
Message:

We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
​https://bugs.webkit.org/show_bug.cgi?id=179562
<rdar://problem/35467022>

Reviewed by Saam Barati.

JSTests:

  • regress-179562.js: Added.

Source/JavaScriptCore:

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGOperations.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculateNotSymbol):
(JSC::DFG::SpeculativeJIT::speculate):

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGUseKind.cpp:

(WTF::printInternal):

  • dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateNotSymbol):

Location:
trunk
Files:
1 added
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r224603 r224735  
     12017-11-12  Mark Lam  <mark.lam@apple.com>
     2
     3        We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
     4        https://bugs.webkit.org/show_bug.cgi?id=179562
     5        <rdar://problem/35467022>
     6
     7        Reviewed by Saam Barati.
     8
     9        * regress-179562.js: Added.
     10
    1112017-11-08  Saam Barati  <sbarati@apple.com>
    212

  • trunk/Source/JavaScriptCore/ChangeLog

    r224726 r224735  
     12017-11-12  Mark Lam  <mark.lam@apple.com>
     2
     3        We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
     4        https://bugs.webkit.org/show_bug.cgi?id=179562
     5        <rdar://problem/35467022>
     6
     7        Reviewed by Saam Barati.
     8
     9        * dfg/DFGFixupPhase.cpp:
     10        (JSC::DFG::FixupPhase::fixupNode):
     11        * dfg/DFGOperations.cpp:
     12        * dfg/DFGSafeToExecute.h:
     13        (JSC::DFG::SafeToExecuteEdge::operator()):
     14        * dfg/DFGSpeculativeJIT.cpp:
     15        (JSC::DFG::SpeculativeJIT::speculateNotSymbol):
     16        (JSC::DFG::SpeculativeJIT::speculate):
     17        * dfg/DFGSpeculativeJIT.h:
     18        * dfg/DFGUseKind.cpp:
     19        (WTF::printInternal):
     20        * dfg/DFGUseKind.h:
     21        (JSC::DFG::typeFilterFor):
     22        * ftl/FTLCapabilities.cpp:
     23        (JSC::FTL::canCompile):
     24        * ftl/FTLLowerDFGToB3.cpp:
     25        (JSC::FTL::DFG::LowerDFGToB3::speculate):
     26        (JSC::FTL::DFG::LowerDFGToB3::speculateNotSymbol):
     27
    1282017-11-11  Devin Rousso  <webkit@devinrousso.com>
    229

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r224594 r224735  
    201201                [&] (Edge& edge) {
    202202                    fixEdge<KnownPrimitiveUse>(edge);
     203                    // StrCat automatically coerces the values into strings before concatenating them.
     204                    // The ECMA spec says that we're not allowed to automatically coerce a Symbol into
     205                    // a string. If a Symbol is encountered, a TypeError will be thrown. As a result,
     206                    // our runtime functions for this slow path expect that they will never be passed
     207                    // Symbols.
     208                    m_insertionSet.insertNode(
     209                        m_indexInBlock, SpecNone, Check, node->origin,
     210                        Edge(edge.node(), NotSymbolUse));
    203211                });
    204212            break;

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r224335 r224735  
    19861986    auto scope = DECLARE_THROW_SCOPE(vm);
    19871987
     1988    ASSERT(!JSValue::decode(a).isSymbol());
     1989    ASSERT(!JSValue::decode(b).isSymbol());
    19881990    JSString* str1 = JSValue::decode(a).toString(exec);
    1989     scope.assertNoException(); // Impossible, since we must have been given primitives.
     1991    scope.assertNoException(); // Impossible, since we must have been given non-Symbol primitives.
    19901992    JSString* str2 = JSValue::decode(b).toString(exec);
    19911993    scope.assertNoException();
    … …  
    20012003    auto scope = DECLARE_THROW_SCOPE(vm);
    20022004
     2005    ASSERT(!JSValue::decode(a).isSymbol());
     2006    ASSERT(!JSValue::decode(b).isSymbol());
     2007    ASSERT(!JSValue::decode(c).isSymbol());
    20032008    JSString* str1 = JSValue::decode(a).toString(exec);
    2004     scope.assertNoException(); // Impossible, since we must have been given primitives.
     2009    scope.assertNoException(); // Impossible, since we must have been given non-Symbol primitives.
    20052010    JSString* str2 = JSValue::decode(b).toString(exec);
    20062011    scope.assertNoException();

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r224594 r224735  
    7474        case StringOrStringObjectUse:
    7575        case NotStringVarUse:
     76        case NotSymbolUse:
    7677        case NotCellUse:
    7778        case OtherUse:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r224594 r224735  
    95439543}
    95449544
     9545void SpeculativeJIT::speculateNotSymbol(Edge edge)
     9546{
     9547    if (!needsTypeCheck(edge, ~SpecSymbol))
     9548        return;
     9549
     9550    JSValueOperand operand(this, edge, ManualOperandSpeculation);
     9551    auto valueRegs = operand.jsValueRegs();
     9552    GPRReg value = valueRegs.payloadGPR();
     9553    JITCompiler::Jump notCell;
     9554
     9555    bool needsCellCheck = needsTypeCheck(edge, SpecCell);
     9556    if (needsCellCheck)
     9557        notCell = m_jit.branchIfNotCell(valueRegs);
     9558
     9559    speculationCheck(BadType, JSValueSource::unboxedCell(value), edge.node(), m_jit.branchIfSymbol(value));
     9560
     9561    if (needsCellCheck)
     9562        notCell.link(&m_jit);
     9563
     9564    m_interpreter.filter(edge, ~SpecSymbol);
     9565}
     9566
    95459567void SpeculativeJIT::speculateSymbol(Edge edge, GPRReg cell)
    95469568{
    … …  
    97319753    case NotStringVarUse:
    97329754        speculateNotStringVar(edge);
     9755        break;
     9756    case NotSymbolUse:
     9757        speculateNotSymbol(edge);
    97339758        break;
    97349759    case NotCellUse:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r224280 r224735  
    31593159    void speculateStringOrOther(Edge);
    31603160    void speculateNotStringVar(Edge);
     3161    void speculateNotSymbol(Edge);
    31613162    template<typename StructureLocationType>
    31623163    void speculateStringObjectForStructure(Edge, StructureLocationType);

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp

    r221959 r224735  
    146146        out.print("NotStringVar");
    147147        return;
     148    case NotSymbolUse:
     149        out.print("NotSymbol");
     150        return;
    148151    case NotCellUse:
    149152        out.print("NotCell");

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.h

    r221959 r224735  
    7373    StringOrStringObjectUse,
    7474    NotStringVarUse,
     75    NotSymbolUse,
    7576    NotCellUse,
    7677    OtherUse,
    … …  
    162163    case NotStringVarUse:
    163164        return ~SpecStringVar;
     165    case NotSymbolUse:
     166        return ~SpecSymbol;
    164167    case NotCellUse:
    165168        return ~SpecCellCheck;

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r224594 r224735  
    513513                case StringIdentUse:
    514514                case NotStringVarUse:
     515                case NotSymbolUse:
    515516                case AnyIntUse:
    516517                case DoubleRepAnyIntUse:

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r224594 r224735  
    1385313853            speculateNotStringVar(edge);
    1385413854            break;
     13855        case NotSymbolUse:
     13856            speculateNotSymbol(edge);
     13857            break;
    1385513858        case NotCellUse:
    1385613859            speculateNotCell(edge);
    … …  
    1444214445    }
    1444314446   
     14447    void speculateNotSymbol(Edge edge)
     14448    {
     14449        if (!m_interpreter.needsTypeCheck(edge, ~SpecSymbol))
     14450            return;
     14451
     14452        ASSERT(mayHaveTypeCheck(edge.useKind()));
     14453        LValue value = lowJSValue(edge, ManualOperandSpeculation);
     14454
     14455        LBasicBlock isCellCase = m_out.newBlock();
     14456        LBasicBlock continuation = m_out.newBlock();
     14457
     14458        m_out.branch(isCell(value, provenType(edge)), unsure(isCellCase), unsure(continuation));
     14459
     14460        LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
     14461        speculate(BadType, jsValueValue(value), edge.node(), isSymbol(value));
     14462        m_out.jump(continuation);
     14463
     14464        m_out.appendTo(continuation, lastNext);
     14465
     14466        m_interpreter.filter(edge, ~SpecSymbol);
     14467    }
     14468
    1444414469    void speculateOther(Edge edge)
    1444514470    {
Note: See TracChangeset for help on using the changeset viewer.