Changeset 233427 in webkit

Timestamp:

Jul 2, 2018 11:04:54 AM (6 years ago)

Author:

keith_miller@apple.com

Message:

InstanceOf IC should do generic if the prototype is not an object.
​https://bugs.webkit.org/show_bug.cgi?id=187250

Reviewed by Mark Lam.

JSTests:

• stress/instanceof-non-object-prototype.js: Added.

(let):
(test):
(i.catch):

Source/JavaScriptCore:

The old code was wrong for two reasons. First, the AccessCase expected that
the prototype value would be non-null. Second, we would end up returning
false instead of throwing an exception.

• jit/Repatch.cpp:

(JSC::tryCacheInstanceOf):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jit/Repatch.cpp (modified) (1 diff)
• jstests (added)
• jstests/stress (added)
• jstests/stress/instanceof-non-object-prototype.js (added)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-07-02  Keith Miller  <keith_miller@apple.com>
+
+        InstanceOf IC should do generic if the prototype is not an object.
+        https://bugs.webkit.org/show_bug.cgi?id=187250
+
+        Reviewed by Mark Lam.
+
+        * stress/instanceof-non-object-prototype.js: Added.
+        (let):
+        (test):
+        (i.catch):
+
 2018-06-30  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-07-02  Keith Miller  <keith_miller@apple.com>
+
+        InstanceOf IC should do generic if the prototype is not an object.
+        https://bugs.webkit.org/show_bug.cgi?id=187250
+
+        Reviewed by Mark Lam.
+
+        The old code was wrong for two reasons. First, the AccessCase expected that
+        the prototype value would be non-null. Second, we would end up returning
+        false instead of throwing an exception.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheInstanceOf):
+
 2018-07-01  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/jit/Repatch.cpp

@@ -737 +737 @@
         
         JSCell* value = valueValue.asCell();
+        Structure* structure = value->structure(vm);
+        std::unique_ptr<AccessCase> newCase;
         JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue);
-        
-        Structure* structure = value->structure(vm);
-        
-        std::unique_ptr<AccessCase> newCase;
-        
-        if (!jsDynamicCast<JSObject*>(vm, value)) {
-            newCase = InstanceOfAccessCase::create(
-                vm, codeBlock, AccessCase::InstanceOfMiss, structure, ObjectPropertyConditionSet(),
-                prototype);
-        } else if (prototype && structure->prototypeQueriesAreCacheable()) {
-            // FIXME: Teach this to do poly proto.
-            // https://bugs.webkit.org/show_bug.cgi?id=185663
-            
-            ObjectPropertyConditionSet conditionSet = generateConditionsForInstanceOf(
-                vm, codeBlock, exec, structure, prototype, wasFound);
-            
-            if (conditionSet.isValid()) {
+        if (prototype) {
+            if (!jsDynamicCast<JSObject*>(vm, value)) {
                 newCase = InstanceOfAccessCase::create(
-                    vm, codeBlock,
-                    wasFound ? AccessCase::InstanceOfHit : AccessCase::InstanceOfMiss,
-                    structure, conditionSet, prototype);
+                    vm, codeBlock, AccessCase::InstanceOfMiss, structure, ObjectPropertyConditionSet(),
+                    prototype);
+            } else if (structure->prototypeQueriesAreCacheable()) {
+                // FIXME: Teach this to do poly proto.
+                // https://bugs.webkit.org/show_bug.cgi?id=185663
+
+                ObjectPropertyConditionSet conditionSet = generateConditionsForInstanceOf(
+                    vm, codeBlock, exec, structure, prototype, wasFound);
+
+                if (conditionSet.isValid()) {
+                    newCase = InstanceOfAccessCase::create(
+                        vm, codeBlock,
+                        wasFound ? AccessCase::InstanceOfHit : AccessCase::InstanceOfMiss,
+                        structure, conditionSet, prototype);
+                }
             }
         }