Changeset 259264 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

Timestamp:

Mar 30, 2020, 6:46:55 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] DFGArrayMode::alreadyChecked should have NonArray check when ArrayMode is NonArray+SlowPutArrayStorage
​https://bugs.webkit.org/show_bug.cgi?id=209791

Reviewed by Saam Barati.

DFGArrayMode::alreadyChecked with NonArray+SlowPutArrayStorage should check NonArray condition.

• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::alreadyChecked const):

• dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::arrayModesWithIndexingShapes const):

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

@@ -512 +512 @@
     case Array::SlowPutArrayStorage:
         switch (arrayClass()) {
-        case Array::OriginalArray: {
+        case Array::OriginalArray:
+        case Array::OriginalCopyOnWriteArray: {
             CRASH();
             return false;
@@ -531 +532 @@
             return true;
         }
-        
-        default: {
+
+        // Array::OriginalNonArray can be shown when the value is a TypedArray with original structure.
+        // But here, we already filtered TypedArrays. So, just handle it like a NonArray.
+        case Array::NonArray:
+        case Array::OriginalNonArray: {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage)))
+                return true;
+            if (value.m_structure.isTop())
+                return false;
+            for (unsigned i = value.m_structure.size(); i--;) {
+                RegisteredStructure structure = value.m_structure[i];
+                if (!hasAnyArrayStorage(structure->indexingType()))
+                    return false;
+                if (structure->indexingType() & IsArray)
+                    return false;
+            }
+            return true;
+        }
+
+        case Array::PossiblyArray: {
             if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage)))
                 return true;
@@ -543 +562 @@
             }
             return true;
-        } }
+        }
+        }
         
     case Array::DirectArguments: