Changeset 285592 in webkit for trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

Timestamp:

Nov 10, 2021, 10:54:59 AM (4 years ago)

Author:

[email protected]

Message:

in_by_val should not constant fold to in_by_id when the property is a property index
​https://bugs.webkit.org/show_bug.cgi?id=232753

Reviewed by Yusuke Suzuki.

JSTests:

• stress/dont-in-by-id-when-index-2.js: Added.

(assert):
(main.v179):
(main.async v244):
(main):

• stress/dont-in-by-id-when-index.js: Added.

(assert):
(test):

Source/JavaScriptCore:

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGValidate.cpp:

File:

• trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -682 +682 @@
                     if (constant.isString()) {
                         JSString* string = asString(constant);
-                        if (CacheableIdentifier::isCacheableIdentifierCell(string)) {
+                        if (CacheableIdentifier::isCacheableIdentifierCell(string) && !parseIndex(CacheableIdentifier::createFromCell(string).uid())) {
                             const StringImpl* impl = string->tryGetValueImpl();
                             RELEASE_ASSERT(impl);