Title: [245443] releases/WebKitGTK/webkit-2.24
- Revision
- 245443
- Author
- [email protected]
- Date
- 2019-05-17 03:14:58 -0700 (Fri, 17 May 2019)
Log Message
Merge r244314 - SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
https://bugs.webkit.org/show_bug.cgi?id=196945
<rdar://problem/49802750>
Reviewed by Filip Pizlo.
JSTests:
* stress/get-by-offset-should-use-correct-child.js: Added.
(foo.bar):
(foo):
Source/_javascript_Core:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog (245442 => 245443)
--- releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog 2019-05-17 10:14:54 UTC (rev 245442)
+++ releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog 2019-05-17 10:14:58 UTC (rev 245443)
@@ -1,3 +1,15 @@
+2019-04-15 Saam barati <[email protected]>
+
+ SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+ https://bugs.webkit.org/show_bug.cgi?id=196945
+ <rdar://problem/49802750>
+
+ Reviewed by Filip Pizlo.
+
+ * stress/get-by-offset-should-use-correct-child.js: Added.
+ (foo.bar):
+ (foo):
+
2019-03-12 Michael Saboff <[email protected]>
REGRESSION (iOS 12.2): Webpage using CoffeeScript crashes
Added: releases/WebKitGTK/webkit-2.24/JSTests/stress/get-by-offset-should-use-correct-child.js (0 => 245443)
--- releases/WebKitGTK/webkit-2.24/JSTests/stress/get-by-offset-should-use-correct-child.js (rev 0)
+++ releases/WebKitGTK/webkit-2.24/JSTests/stress/get-by-offset-should-use-correct-child.js 2019-05-17 10:14:58 UTC (rev 245443)
@@ -0,0 +1,25 @@
+function foo(x) {
+ for (let i = 0; i < 400; i++) {
+ for (let j = 0; j < 2; j++) {
+ for (const k of arguments) {
+ }
+ arguments.length = 0;
+ const q = {
+ z: 0
+ };
+ function bar() {
+ q;
+ }
+ for (let w = 0; w < 300; w++) {
+ }
+ }
+
+ with ({}) {
+ }
+
+ +{};
+ }
+}
+
+foo(0);
+foo(0);
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog (245442 => 245443)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-05-17 10:14:54 UTC (rev 245442)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-05-17 10:14:58 UTC (rev 245443)
@@ -1,3 +1,14 @@
+2019-04-15 Saam barati <[email protected]>
+
+ SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
+ https://bugs.webkit.org/show_bug.cgi?id=196945
+ <rdar://problem/49802750>
+
+ Reviewed by Filip Pizlo.
+
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+
2019-04-03 Myles C. Maxfield <[email protected]>
-apple-trailing-word is needed for browser detection
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/dfg/DFGSafeToExecute.h (245442 => 245443)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2019-05-17 10:14:54 UTC (rev 245442)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2019-05-17 10:14:58 UTC (rev 245443)
@@ -544,13 +544,13 @@
// know anything about inferred types. But if we have a proof derived from watching a
// structure that has a type proof, then the next case below will deal with it.
if (state.structureClobberState() == StructuresAreWatched) {
- if (JSObject* knownBase = node->child1()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
+ if (JSObject* knownBase = node->child2()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
if (graph.isSafeToLoad(knownBase, offset))
return true;
}
}
- StructureAbstractValue& value = state.forNode(node->child1()).m_structure;
+ StructureAbstractValue& value = state.forNode(node->child2()).m_structure;
if (value.isInfinite())
return false;
for (unsigned i = value.size(); i--;) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
