Changeset 90768 in webkit

Timestamp:

Jul 11, 2011 11:39:14 AM (13 years ago)

Author:

commit-queue@webkit.org

Message:

DFG Speculative JIT does not always insert speculation checks when speculating
arrays.
​https://bugs.webkit.org/show_bug.cgi?id=64254

Patch by Filip Pizlo <​fpizlo@apple.com> on 2011-07-11
Reviewed by Gavin Barraclough.

Changed the SetLocal instruction to always validate that the value being stored
into the local variable is an array, if that variable was marked PredictArray.
This is necessary since uses of arrays assume that if a PredictArray value is
in a local variable then the speculation check validating that the value is an
array was already performed.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-07-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Speculative JIT does not always insert speculation checks when speculating
+        arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=64254
+
+        Reviewed by Gavin Barraclough.
+        
+        Changed the SetLocal instruction to always validate that the value being stored
+        into the local variable is an array, if that variable was marked PredictArray.
+        This is necessary since uses of arrays assume that if a PredictArray value is
+        in a local variable then the speculation check validating that the value is an
+        array was already performed.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-07-11  Gabor Loki  <loki@webkit.org>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -492 +492 @@
         case PredictArray: {
             SpeculateCellOperand cell(this, node.child1());
-            m_jit.storePtr(cell.gpr(), JITCompiler::addressFor(node.local()));
+            GPRReg cellGPR = cell.gpr();
+            speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(cellGPR), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+            m_jit.storePtr(cellGPR, JITCompiler::addressFor(node.local()));
             noResult(m_compileIndex);
             break;