Changeset 238596 in webkit

Timestamp:

Nov 27, 2018 6:03:20 PM (5 years ago)

Author:

sbarati@apple.com

Message:

r238510 broke scopes of size zero
​https://bugs.webkit.org/show_bug.cgi?id=192033
<rdar://problem/46281734>

Reviewed by Keith Miller.

JSTests:

• stress/r238510-bad-loop.js: Added.

(foo):

Source/JavaScriptCore:

In r238510, I wrote the loop like this:
for (ScopeOffset offset { 0 }; offset <= symbolTable->maxScopeOffset(); offset += 1)

This breaks for scopes of size zero because maxScopeOffset() will be UINT_MAX.

This patch fixes this by writing the loop as:
for (unsigned offset = 0; offset < symbolTable->scopeSize(); ++offset)

• dfg/DFGObjectAllocationSinkingPhase.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/r238510-bad-loop.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-11-27  Saam barati  <sbarati@apple.com>
+
+        r238510 broke scopes of size zero
+        https://bugs.webkit.org/show_bug.cgi?id=192033
+        <rdar://problem/46281734>
+
+        Reviewed by Keith Miller.
+
+        * stress/r238510-bad-loop.js: Added.
+        (foo):
+
 2018-11-27  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-11-27  Saam barati  <sbarati@apple.com>
+
+        r238510 broke scopes of size zero
+        https://bugs.webkit.org/show_bug.cgi?id=192033
+        <rdar://problem/46281734>
+
+        Reviewed by Keith Miller.
+
+        In r238510, I wrote the loop like this: 
+        `for (ScopeOffset offset { 0 }; offset <= symbolTable->maxScopeOffset(); offset += 1)`
+        
+        This breaks for scopes of size zero because maxScopeOffset() will be UINT_MAX.
+        
+        This patch fixes this by writing the loop as:
+        `for (unsigned offset = 0; offset < symbolTable->scopeSize(); ++offset)`
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
 2018-11-27  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

@@ -879 +879 @@
                 SymbolTable* symbolTable = node->castOperand<SymbolTable*>();
                 LazyNode initialValue(m_graph.freeze(node->initializationValueForActivation()));
-                for (ScopeOffset offset { 0 }; offset <= symbolTable->maxScopeOffset(); offset += 1) {
+                for (unsigned offset = 0; offset < symbolTable->scopeSize(); ++offset) {
                     writes.add(
-                        PromotedLocationDescriptor(ClosureVarPLoc, offset.offset()),
+                        PromotedLocationDescriptor(ClosureVarPLoc, offset),
                         initialValue);
                 }