Changeset 251178 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Oct 15, 2019, 9:01:18 PM (6 years ago)

Author:

[email protected]

Message:

operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
​https://bugs.webkit.org/show_bug.cgi?id=202312
<rdar://problem/55782280>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
• stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
• stress/switch-on-char-llint-rope.js:
• Changed this test to make a new rope string for each iterations. Otherwise, the rope will get resolved, and subsequent tiers will not be testing with a rope.

Source/JavaScriptCore:

operationSwitchCharWithUnknownKeyType() can only dispatch to a case handler
if the key string is of length 1. All other cases should dispatch to the default
handler. This patch also adds the missing OOME check.

Also fixed a bug in SpeculativeJIT::emitSwitchCharStringJump() where the slow
path rope resolution was returning after the length check. It needs to return to
the point before the length check.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump):

• jit/JITOperations.cpp:

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -10720 +10720 @@
     m_jit.loadPtr(MacroAssembler::Address(value, JSString::offsetOfValue()), scratch);
     auto isRope = m_jit.branchIfRopeStringImpl(scratch);
-
+    addSlowPathGenerator(slowPathCall(isRope, this, operationResolveRope, scratch, value));
+    
     addBranch(
         m_jit.branch32(
@@ -10727 +10728 @@
             TrustedImm32(1)),
         data->fallThrough.block);
-    
-    addSlowPathGenerator(slowPathCall(isRope, this, operationResolveRope, scratch, value));
-    
+
     m_jit.loadPtr(MacroAssembler::Address(scratch, StringImpl::dataOffset()), value);