Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge r243280 - Cap length of an array with spread to MIN_ARRAY_STORA…
…GE_CONSTRUCTION_LENGTH. https://bugs.webkit.org/show_bug.cgi?id=196055 <rdar://problem/49067448> Reviewed by Yusuke Suzuki. JSTests: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: Added. Source/JavaScriptCore: We are doing this because: 1. We expect the array to be densely packed. 2. SpeculativeJIT::compileAllocateNewArrayWithSize() (and the FTL equivalent) expects the array length to be less than MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH if we don't want to use an ArrayStorage shape. 3. There's no reason why an array with spread needs to be that large anyway. MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH is plenty. In this patch, we also add a debug assert in compileAllocateNewArrayWithSize() and emitAllocateButterfly() to check for overflows. * assembler/AbortReason.h: * dfg/DFGOperations.cpp: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileCreateRest): (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread): (JSC::DFG::SpeculativeJIT::emitAllocateButterfly): (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread): * runtime/ArrayConventions.h: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL):
- Loading branch information
1 parent
53b2fcb
commit 4d94440
Showing
9 changed files
with
124 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44 changes: 44 additions & 0 deletions
44
...s/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,44 @@ | ||
//@ skip if $memoryLimited or $buildType == "debug" | ||
|
||
function test() { | ||
function makeFoo(n) { | ||
let src = "return function(a, b) { for (let i = 0; i < 20000; i++); return ["; | ||
for (let i = 0; i < n; i++) { | ||
src += "...a"; | ||
if (i < n-1) | ||
src += ","; | ||
} | ||
src += ",...b];}"; | ||
return (new Function(src))(); | ||
} | ||
|
||
var NUM_SPREAD_ARGS = 8; | ||
var foo = makeFoo(NUM_SPREAD_ARGS); | ||
|
||
var b = [1.1, 1.1]; | ||
for (let i = 0; i < 10; i++) | ||
foo(b, b); | ||
|
||
function makeArray(len, v = 1.234) { | ||
let a = []; | ||
while (a.length < len) | ||
a[a.length] = v; | ||
return a; | ||
} | ||
|
||
var a = makeArray(0x20000040 / NUM_SPREAD_ARGS); | ||
var c = []; c.length = 1; | ||
|
||
var arr = foo(a, c); | ||
print(arr.length); | ||
} | ||
|
||
var exception; | ||
try { | ||
test(); | ||
} catch (e) { | ||
exception = e; | ||
} | ||
|
||
if (exception != "Error: Out of memory") | ||
throw "FAILED"; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters