Title: [243906] trunk/JSTests
- Revision
- 243906
- Author
- [email protected]
- Date
- 2019-04-04 14:13:26 -0700 (Thu, 04 Apr 2019)
Log Message
createRegExpMatchesArray does not respect inferred types
https://bugs.webkit.org/show_bug.cgi?id=193287
Reviewed by Yusuke Suzuki.
This checks in the test case for 193287. This issue was discovered by
Samuel Groß of Google Project Zero.
* stress/inferred-types-regex-matches-array.js: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (243905 => 243906)
--- trunk/JSTests/ChangeLog 2019-04-04 21:10:29 UTC (rev 243905)
+++ trunk/JSTests/ChangeLog 2019-04-04 21:13:26 UTC (rev 243906)
@@ -1,3 +1,15 @@
+2019-04-04 Saam Barati <[email protected]>
+
+ createRegExpMatchesArray does not respect inferred types
+ https://bugs.webkit.org/show_bug.cgi?id=193287
+
+ Reviewed by Yusuke Suzuki.
+
+ This checks in the test case for 193287. This issue was discovered by
+ Samuel Groß of Google Project Zero.
+
+ * stress/inferred-types-regex-matches-array.js: Added.
+
2019-04-04 Saam barati <[email protected]>
Teach Call ICs how to call Wasm
Added: trunk/JSTests/stress/inferred-types-regex-matches-array.js (0 => 243906)
--- trunk/JSTests/stress/inferred-types-regex-matches-array.js (rev 0)
+++ trunk/JSTests/stress/inferred-types-regex-matches-array.js 2019-04-04 21:13:26 UTC (rev 243906)
@@ -0,0 +1,48 @@
+let objX = {objProperty: {fetchme: 1234}};
+let objY = {doubleProperty: 2130562.5098039214};
+
+function createArray() {
+ let protoWithIndexedAccessors = {};
+ Object.defineProperty(protoWithIndexedAccessors, 1337, { get() { return 1337; } });
+
+ function helper(i) {
+ let a = new Array;
+ if (i > 0) {
+ Object.setPrototypeOf(a, protoWithIndexedAccessors);
+ }
+ return a;
+ }
+
+ for (let i = 1; i < 10000; i++) {
+ helper(i);
+ }
+ return helper(0);
+}
+
+let obj = {};
+obj.inlineProperty1 = 1337;
+obj.inlineProperty2 = 1338;
+obj.oolProperty1 = objX;
+
+let a = createArray();
+a.index = 42;
+a.input = "foobar";
+a.groups = obj;
+
+global = a;
+global = a;
+
+Object.defineProperty(Array.prototype, 1337, { get() { return 1337; } });
+
+function foo() {
+ return global.groups.oolProperty1.objProperty.fetchme;
+}
+
+for (let i = 0; i < 10000; i++) {
+ foo(i);
+}
+
+let match = "foo".match(/(?<oolProperty1>foo)/);
+match.groups.oolProperty1 = objY; // This property overlaps with oolProperty1 of structure S3.
+global = match;
+foo();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
