Changeset 239287 in webkit

Timestamp:

Dec 17, 2018, 1:32:39 PM (6 years ago)

Author:

mark.lam@apple.com

Message:

Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
​https://bugs.webkit.org/show_bug.cgi?id=192770
<rdar://problem/46449037>

Reviewed by Keith Miller.

JSTests:

• stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.

Source/JavaScriptCore:

This assertion was added before Array::OriginalNonArray was introduced. It just
needs to be updated to allow for Array::OriginalNonArray.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/force-string-arrayMode-on-originalNonArray-array-class.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-12-17  Mark Lam  <mark.lam@apple.com>
+
+        Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
+        https://bugs.webkit.org/show_bug.cgi?id=192770
+        <rdar://problem/46449037>
+
+        Reviewed by Keith Miller.
+
+        * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
+
 2018-12-14  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-12-17  Mark Lam  <mark.lam@apple.com>
+
+        Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
+        https://bugs.webkit.org/show_bug.cgi?id=192770
+        <rdar://problem/46449037>
+
+        Reviewed by Keith Miller.
+
+        This assertion was added before Array::OriginalNonArray was introduced.  It just
+        needs to be updated to allow for Array::OriginalNonArray.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
+
 2018-12-17  Matt Lewis  <jlewis3@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -2433 +2433 @@
     void attemptToForceStringArrayModeByToStringConversion(ArrayMode& arrayMode, Node* node)
     {
-        ASSERT(arrayMode == ArrayMode(Array::Generic, Array::Read));
+        ASSERT(arrayMode == ArrayMode(Array::Generic, Array::Read) || arrayMode == ArrayMode(Array::Generic, Array::OriginalNonArray, Array::Read));
         
         if (!m_graph.canOptimizeStringObjectAccess(node->origin.semantic))