Title: [242871] releases/WebKitGTK/webkit-2.24
- Revision
- 242871
- Author
- [email protected]
- Date
- 2019-03-13 02:25:19 -0700 (Wed, 13 Mar 2019)
Log Message
Merge r242810 - The HasIndexedProperty node does GC.
https://bugs.webkit.org/show_bug.cgi?id=195559
<rdar://problem/48767923>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/HasIndexedProperty-does-gc.js: Added.
Source/_javascript_Core:
HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
which can eventually call JSString::getIndex(), which can resolve a rope.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog (242870 => 242871)
--- releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog 2019-03-13 09:25:15 UTC (rev 242870)
+++ releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog 2019-03-13 09:25:19 UTC (rev 242871)
@@ -1,3 +1,13 @@
+2019-03-12 Mark Lam <[email protected]>
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/HasIndexedProperty-does-gc.js: Added.
+
2019-03-08 Mark Lam <[email protected]>
Stack overflow crash in JSC::JSObject::hasInstance.
Added: releases/WebKitGTK/webkit-2.24/JSTests/stress/HasIndexedProperty-does-gc.js (0 => 242871)
--- releases/WebKitGTK/webkit-2.24/JSTests/stress/HasIndexedProperty-does-gc.js (rev 0)
+++ releases/WebKitGTK/webkit-2.24/JSTests/stress/HasIndexedProperty-does-gc.js 2019-03-13 09:25:19 UTC (rev 242871)
@@ -0,0 +1,9 @@
+// This test should not crash.
+function foo(a) {
+ return 0 in a;
+}
+for (let i = 0; i < 100000; i++) {
+ const str = new String('asdf');
+ str[42] = 'x'; // Give it ArrayStorage
+ foo(str);
+}
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog (242870 => 242871)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-03-13 09:25:15 UTC (rev 242870)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-03-13 09:25:19 UTC (rev 242871)
@@ -1,3 +1,17 @@
+2019-03-12 Mark Lam <[email protected]>
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+ which can eventually call JSString::getIndex(), which can resolve a rope.
+
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+
2019-03-08 Mark Lam <[email protected]>
Stack overflow crash in JSC::JSObject::hasInstance.
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/dfg/DFGDoesGC.cpp (242870 => 242871)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2019-03-13 09:25:15 UTC (rev 242870)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2019-03-13 09:25:19 UTC (rev 242871)
@@ -195,7 +195,6 @@
case GetByOffset:
case GetGetterSetterByOffset:
case GetEnumerableLength:
- case HasIndexedProperty:
case FiatInt52:
case BooleanToNumber:
case CheckBadCell:
@@ -282,6 +281,7 @@
case GetDynamicVar:
case GetMapBucket:
case HasGenericProperty:
+ case HasIndexedProperty:
case HasOwnProperty:
case HasStructureProperty:
case InById:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
