Changeset 254434 in webkit


Ignore:
Timestamp:
Jan 13, 2020 9:19:56 AM (4 years ago)
Author:
keith_miller@apple.com
Message:

CheckNeutered needs to claim it reads JSType in clobberize.
​https://bugs.webkit.org/show_bug.cgi?id=206136

Reviewed by Yusuke Suzuki.

JSTests:

  • stress/check-neutered-clobberize-reads-jstype.js: Added.

(foo):

Source/JavaScriptCore:

CheckNeutered needs to read JSType otherwise it can get hoisted
past the TypedArray check guarding it.

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

Location:
trunk
Files:
1 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r254420 r254434  
     12020-01-11  Keith Miller  <keith_miller@apple.com>
     2
     3        CheckNeutered needs to claim it reads JSType in clobberize.
     4        https://bugs.webkit.org/show_bug.cgi?id=206136
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        * stress/check-neutered-clobberize-reads-jstype.js: Added.
     9        (foo):
     10
    1112020-01-12  Yusuke Suzuki  <ysuzuki@apple.com>
    212

  • trunk/Source/JavaScriptCore/ChangeLog

    r254420 r254434  
     12020-01-11  Keith Miller  <keith_miller@apple.com>
     2
     3        CheckNeutered needs to claim it reads JSType in clobberize.
     4        https://bugs.webkit.org/show_bug.cgi?id=206136
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        CheckNeutered needs to read JSType otherwise it can get hoisted
     9        past the TypedArray check guarding it.
     10
     11        * dfg/DFGAbstractInterpreterInlines.h:
     12        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
     13        * dfg/DFGClobberize.h:
     14        (JSC::DFG::clobberize):
     15
    1162020-01-12  Yusuke Suzuki  <ysuzuki@apple.com>
    217

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r254252 r254434  
    33623362
    33633363    case CheckNeutered: {
     3364        DFG_ASSERT(m_graph, node, speculationChecked(forNode(node->child1()).m_type, SpecTypedArrayView));
    33643365        break;
    33653366    }

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r254252 r254434  
    11031103
    11041104    case CheckNeutered:
     1105        read(JSCell_typeInfoType);
     1106        read(JSCell_structureID);
    11051107        read(MiscFields);
    11061108        return;
Note: See TracChangeset for help on using the changeset viewer.