Title: [242862] branches/safari-607-branch
- Revision
- 242862
- Author
- [email protected]
- Date
- 2019-03-13 01:24:57 -0700 (Wed, 13 Mar 2019)
Log Message
Cherry-pick r242810. rdar://problem/48839349
The HasIndexedProperty node does GC.
https://bugs.webkit.org/show_bug.cgi?id=195559
<rdar://problem/48767923>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/HasIndexedProperty-does-gc.js: Added.
Source/_javascript_Core:
HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
which can eventually call JSString::getIndex(), which can resolve a rope.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242810 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/JSTests/ChangeLog (242861 => 242862)
--- branches/safari-607-branch/JSTests/ChangeLog 2019-03-13 08:24:54 UTC (rev 242861)
+++ branches/safari-607-branch/JSTests/ChangeLog 2019-03-13 08:24:57 UTC (rev 242862)
@@ -1,5 +1,41 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242810. rdar://problem/48839349
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/HasIndexedProperty-does-gc.js: Added.
+
+ Source/_javascript_Core:
+
+ HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+ which can eventually call JSString::getIndex(), which can resolve a rope.
+
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242810 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-12 Mark Lam <[email protected]>
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/HasIndexedProperty-does-gc.js: Added.
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242667. rdar://problem/48839311
Stack overflow crash in JSC::JSObject::hasInstance.
Added: branches/safari-607-branch/JSTests/stress/HasIndexedProperty-does-gc.js (0 => 242862)
--- branches/safari-607-branch/JSTests/stress/HasIndexedProperty-does-gc.js (rev 0)
+++ branches/safari-607-branch/JSTests/stress/HasIndexedProperty-does-gc.js 2019-03-13 08:24:57 UTC (rev 242862)
@@ -0,0 +1,9 @@
+// This test should not crash.
+function foo(a) {
+ return 0 in a;
+}
+for (let i = 0; i < 100000; i++) {
+ const str = new String('asdf');
+ str[42] = 'x'; // Give it ArrayStorage
+ foo(str);
+}
Modified: branches/safari-607-branch/Source/_javascript_Core/ChangeLog (242861 => 242862)
--- branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-03-13 08:24:54 UTC (rev 242861)
+++ branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-03-13 08:24:57 UTC (rev 242862)
@@ -1,5 +1,45 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242810. rdar://problem/48839349
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/HasIndexedProperty-does-gc.js: Added.
+
+ Source/_javascript_Core:
+
+ HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+ which can eventually call JSString::getIndex(), which can resolve a rope.
+
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242810 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-12 Mark Lam <[email protected]>
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+ which can eventually call JSString::getIndex(), which can resolve a rope.
+
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242667. rdar://problem/48839311
Stack overflow crash in JSC::JSObject::hasInstance.
Modified: branches/safari-607-branch/Source/_javascript_Core/dfg/DFGDoesGC.cpp (242861 => 242862)
--- branches/safari-607-branch/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2019-03-13 08:24:54 UTC (rev 242861)
+++ branches/safari-607-branch/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2019-03-13 08:24:57 UTC (rev 242862)
@@ -201,7 +201,6 @@
case GetByOffset:
case GetGetterSetterByOffset:
case GetEnumerableLength:
- case HasIndexedProperty:
case FiatInt52:
case BooleanToNumber:
case CheckBadCell:
@@ -288,6 +287,7 @@
case GetDynamicVar:
case GetMapBucket:
case HasGenericProperty:
+ case HasIndexedProperty:
case HasOwnProperty:
case HasStructureProperty:
case InById:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
