Changeset 109040 in webkit for trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

Timestamp:

Feb 27, 2012, 4:37:58 PM (13 years ago)

Author:

[email protected]

Message:

Old JIT's style of JSVALUE64 strict equality is subtly wrong
​https://bugs.webkit.org/show_bug.cgi?id=79700

Reviewed by Oliver Hunt.

• assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::comparePtr):
(MacroAssemblerX86_64):

• dfg/DFGOperations.cpp:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):

• jit/JITOpcodes.cpp:

(JSC::JIT::compileOpStrictEq):
(JSC::JIT::emitSlow_op_stricteq):
(JSC::JIT::emitSlow_op_nstricteq):

• jit/JITStubs.cpp:

(JSC::DEFINE_STUB_FUNCTION):

File:

• trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -737 +737 @@
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
-    
-    return JSValue::strictEqual(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+
+    JSValue src1 = JSValue::decode(encodedOp1);
+    JSValue src2 = JSValue::decode(encodedOp2);
+    
+    ASSERT((src1.isCell() && src2.isCell())
+           || src1.isDouble() || src2.isDouble());
+    
+    return JSValue::strictEqual(exec, src1, src2);
 }