Changeset 266254 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Aug 27, 2020, 2:16:01 PM (5 years ago)

Author:

[email protected]

Message:

GetByVal constant folding over a Double OutOfBoundsSaneChain array with no BytecodeUsesAsOther should constant fold to PNaN, not undefined
​https://bugs.webkit.org/show_bug.cgi?id=215894
<rdar://problem/67669696>

Reviewed by Michael Saboff and Keith Miller.

JSTests:

• stress/oob-sane-chain-double-constant-fold-to-PNaN.js: Added.

Source/JavaScriptCore:

GetByVals of the form { OutOfBoundsSaneChain, Double } where there are no
BytecodeUsesAsOther return PNaN for holes and OOB accesses, not jsUndefined().
The constant folding for this though was folding to jsUndefined(). I forgot
to update that code to constant fold to PNaN when I wrote the OutOfBoundsSaneChain
implementation.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-08-27  Saam Barati  <[email protected]>
+
+        GetByVal constant folding over a Double OutOfBoundsSaneChain array with no BytecodeUsesAsOther should constant fold to PNaN, not undefined
+        https://bugs.webkit.org/show_bug.cgi?id=215894
+        <rdar://problem/67669696>
+
+        Reviewed by Michael Saboff and Keith Miller.
+
+        GetByVals of the form { OutOfBoundsSaneChain, Double } where there are no
+        BytecodeUsesAsOther return PNaN for holes and OOB accesses, not jsUndefined().
+        The constant folding for this though was folding to jsUndefined(). I forgot
+        to update that code to constant fold to PNaN when I wrote the OutOfBoundsSaneChain
+        implementation.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2020-08-27  Keith Miller  <[email protected]>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -2239 +2239 @@
                             m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
                             m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
-                            // Note that Array::Double and Array::Int32 return JSValue if array mode is OutOfBounds.
-                            setConstant(node, jsUndefined());
+                            if (node->arrayMode().type() == Array::Double && node->arrayMode().isOutOfBoundsSaneChain() && !(node->flags() & NodeBytecodeUsesAsOther))
+                                setConstant(node, jsNumber(PNaN));
+                            else
+                                setConstant(node, jsUndefined());
                             return true;
                         }