Changeset 265112 in webkit

Timestamp:

Jul 30, 2020 3:17:10 PM (4 years ago)

Author:

Caio Lima

Message:

[JSC][32-bits] interator_next should check for EmptyValue instead of undefined to execute LLInt fast path
​https://bugs.webkit.org/show_bug.cgi?id=214963

Reviewed by Yusuke Suzuki.

JSTests:

• stress/invalidate-array-iterator-prototype-next.js: Added.

Source/JavaScriptCore:

There was a bug in previous implementation that allows execution of
interator_next fast path if we set ArrayIterator.prototype.next to

0. This happened because we were not properly checking ValueEmpty

from m_next. This patch is fixing such issue and doing the proper
verification.

• llint/LowLevelInterpreter32_64.asm:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/invalidate-array-iterator-prototype-next.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-07-30  Caio Lima  <ticaiolima@gmail.com>
+
+        [JSC][32-bits] interator_next should check for EmptyValue instead of undefined to execute LLInt fast path
+        https://bugs.webkit.org/show_bug.cgi?id=214963
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/invalidate-array-iterator-prototype-next.js: Added.
+
 2020-07-30  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-07-30  Caio Lima  <ticaiolima@gmail.com>
+
+        [JSC][32-bits] interator_next should check for EmptyValue instead of undefined to execute LLInt fast path
+        https://bugs.webkit.org/show_bug.cgi?id=214963
+
+        Reviewed by Yusuke Suzuki.
+
+        There was a bug in previous implementation that allows execution of
+        `interator_next` fast path if we set ArrayIterator.prototype.next to
+        0. This happened because we were not properly checking `ValueEmpty`
+        from `m_next`. This patch is fixing such issue and doing the proper
+        verification.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
 2020-07-30  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

@@ -2770 +2770 @@
         
     loadVariable(get, m_next, t0, t1, t0)
-    bieq t1, UndefinedTag, .iteratorNextGeneric
-    btinz t0, .iteratorNextGeneric
+    bineq t1, EmptyValueTag, .iteratorNextGeneric
 
     macro fastNarrow()