Changeset 120121 in webkit for trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

Timestamp:

Jun 12, 2012, 2:15:43 PM (13 years ago)

Author:

[email protected]

Message:

REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object
​https://bugs.webkit.org/show_bug.cgi?id=88783
<rdar://problem/11640299>

Source/JavaScriptCore:

Reviewed by Geoffrey Garen.

If you don't keep alive the base of an object access over the various checks
you do for the prototype chain, you're going to have a bad time.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleGetById):

LayoutTests:

Reviewed by Geoffrey Garen.

• fast/js/dfg-proto-access-inline-osr-exit-expected.txt: Added.
• fast/js/dfg-proto-access-inline-osr-exit.html: Added.
• fast/js/script-tests/dfg-proto-access-inline-osr-exit.js: Added.

(foo):
(Thingy):

File:

• trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -1563 +1563 @@
     if (prediction == SpecNone)
         addToGraph(ForceOSRExit);
+    
+    NodeIndex originalBaseForBaselineJIT = base;
                 
     addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(getByIdStatus.structureSet())), base);
@@ -1580 +1582 @@
         useInlineStorage = getByIdStatus.structureSet().allAreUsingInlinePropertyStorage();
     
+    // Unless we want bugs like https://bugs.webkit.org/show_bug.cgi?id=88783, we need to
+    // ensure that the base of the original get_by_id is kept alive until we're done with
+    // all of the speculations. We only insert the Phantom if there had been a CheckStructure
+    // on something other than the base following the CheckStructure on base, or if the
+    // access was compiled to a WeakJSConstant specific value, in which case we might not
+    // have any explicit use of the base at all.
+    if (getByIdStatus.specificValue() || originalBaseForBaselineJIT != base)
+        addToGraph(Phantom, originalBaseForBaselineJIT);
+    
     if (getByIdStatus.specificValue()) {
         ASSERT(getByIdStatus.specificValue().isCell());
+        
         set(destinationOperand,
             addToGraph(WeakJSConstant, OpInfo(getByIdStatus.specificValue().asCell())));