Changeset 154120 in webkit for trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

Timestamp:

Aug 15, 2013, 12:44:16 PM (12 years ago)

Author:

[email protected]

Message:

<​https://webkit.org/b/119830> Assigning to a readonly global results in DFG byte code parse failure

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Make sure dfgCapabilities doesn't report a Dynamic put as
being compilable when we don't actually support it.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

LayoutTests:

Add a test

• fast/js/dfg-put-to-readonly-property-expected.txt: Added.
• fast/js/dfg-put-to-readonly-property.html: Added.
• fast/js/script-tests/dfg-put-to-readonly-property.js: Added.

(foo):
(bar):

File:

• trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

@@ -171 +171 @@
     case op_in:
     case op_get_from_scope:
-    case op_put_to_scope:
         return CanCompileAndInline;
+
+    case op_put_to_scope: {
+        ResolveType resolveType = ResolveModeAndType(pc[4].u.operand).type();
+        // If we're writing to a readonly property we emit a Dynamic put that
+        // the DFG can't currently handle.
+        if (resolveType == Dynamic)
+            return CannotCompile;
+        return CanCompileAndInline;
+    }
 
     case op_resolve_scope: {
         // We don't compile 'catch' or 'with', so there's no point in compiling variable resolution within them.
-        ResolveType resolveType = static_cast<ResolveType>(pc[3].u.operand);
+        ResolveType resolveType = ResolveModeAndType(pc[4].u.operand).type();
         if (resolveType == Dynamic)
             return CannotCompile;