-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[JSC] We should have accept-any-value case generation for IC
https://bugs.webkit.org/show_bug.cgi?id=259327 rdar://112502090 Reviewed by Michael Saboff. When we generate IC for get-by-val / get-by-val-with-this, we check whether each IC needs Int32 / String / Symbol checks. And if we find some of IC case requires it, then we do this check and generating code. But we are missing that we generate accept-any-value case in this path (which is IndexedProxyObjectLoad). This is clearly wrong, and attached script is repeatedly compiling IC because we are not generating IndexedProxyObjectLoad case. And if this IC site is requiring some register spills, then it leads to release-assert-crash because 1. It says doesJSCalls = true 2. But not setting spillStateForJSCall So, we will encounter empty spillStateForJSCall. It is actually super hard to reproduce this issue, and we cannot find a case. But anyway, this fixes the obvious issue, which is not generating listed IC, which is tested in the attached test. * JSTests/stress/proxy-get-with-complex-string.js: Added. (test): * Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp: (JSC::InlineCacheCompiler::regenerate): Canonical link: https://commits.webkit.org/266164@main
- Loading branch information
1 parent
c7f1348
commit eaa5055
Showing
2 changed files
with
39 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
function test(object, value) { | ||
return object[value]; | ||
} | ||
noInline(test); | ||
|
||
var proxy = new Proxy({}, {}); | ||
var object = { hello: 42 }; | ||
for (var i = 0; i < 1e6; ++i) { | ||
test(proxy, "hello"); | ||
test(object, "hello"); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters