Changeset 252766 in webkit

Timestamp:

Nov 22, 2019 1:39:04 AM (4 years ago)

Author:

mark.lam@apple.com

Message:

replaceUsingStringSearch() should not use CachedCall with host functions.
​https://bugs.webkit.org/show_bug.cgi?id=204494
<rdar://problem/57421078>

Reviewed by Ross Kirsling.

JSTests:

• stress/string-replaceAll-2.js:

Source/JavaScriptCore:

The CachedCall mechanism does not support calling hist functions.

• runtime/StringPrototype.cpp:

(JSC::replaceUsingStringSearch):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/string-replaceAll-2.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/StringPrototype.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-11-21  Mark Lam  <mark.lam@apple.com>
+
+        replaceUsingStringSearch() should not use CachedCall with host functions.
+        https://bugs.webkit.org/show_bug.cgi?id=204494
+        <rdar://problem/57421078>
+
+        Reviewed by Ross Kirsling.
+
+        * stress/string-replaceAll-2.js:
+
 2019-11-21  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/JSTests/stress/string-replaceAll-2.js

@@ -108 +108 @@
     { result: '51525352545', visits: 6 }, // replace /(?:)/g
     { result: '51525352545', visits: 6 }, // replaceAll ''
+    { result: '12324', visits: 0 }, // replace '0'
+    { result: '12324', visits: 0 }, // replace /0/g
+    { result: '12324', visits: 0 }, // replaceAll '0'
+]);
+
+test("function parseInt", parseInt, [
+    { result: '1NaN324', visits: 0 }, // replace '2'
+    { result: '1NaN324', visits: 0 }, // replace /2/g
+    { result: '1NaN324', visits: 0 }, // replaceAll '2'
+    { result: 'NaN12324', visits: 0 }, // replace ''
+    { result: 'NaN1NaN2NaN3NaN2NaN4NaN', visits: 0 }, // replace /(?:)/g
+    { result: 'NaN1NaN2NaN3NaN2NaN4NaN', visits: 0 }, // replaceAll ''
     { result: '12324', visits: 0 }, // replace '0'
     { result: '12324', visits: 0 }, // replace /0/g

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-11-21  Mark Lam  <mark.lam@apple.com>
+
+        replaceUsingStringSearch() should not use CachedCall with host functions.
+        https://bugs.webkit.org/show_bug.cgi?id=204494
+        <rdar://problem/57421078>
+
+        Reviewed by Ross Kirsling.
+
+        The CachedCall mechanism does not support calling hist functions.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingStringSearch):
+
 2019-11-21  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp

@@ -794 +794 @@
         replaceString = replaceValue.toWTFString(globalObject);
         RETURN_IF_EXCEPTION(scope, nullptr);
-    } else {
-        JSFunction* function = jsDynamicCast<JSFunction*>(vm, replaceValue);
-        if (function) {
-            cachedCall.emplace(globalObject, callFrame, function, 3);
-            cachedCall->setThis(jsUndefined());
-        }
+    } else if (callType == CallType::JS) {
+        cachedCall.emplace(globalObject, callFrame, jsCast<JSFunction*>(replaceValue), 3);
+        cachedCall->setThis(jsUndefined());
     }