Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge r176972 - CFA wrongly assumes that a speculation for SlowPutArr…
…ayStorageShape disallows ArrayStorageShape arrays. <https://webkit.org/b/139327> Reviewed by Michael Saboff. Source/JavaScriptCore: The code generator and runtime slow paths expects otherwise. This patch fixes CFA to match the code generator's expectation. * dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::arrayModesThatPassFiltering): (JSC::DFG::ArrayMode::arrayModesWithIndexingShapes): LayoutTests: * js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt: Added. * js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html: Added. * js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js: Added. (foo): (test): Canonical link: https://commits.webkit.org/154760.265@webkitgtk/2.6 git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178334 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- Loading branch information
1 parent
462be38
commit ee513bf
Showing
6 changed files
with
92 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
This tests that DFG generated code speculating SlowPutArrayStorageShape doesn't crash when seeing fast ArrayStorageShapes. | ||
|
||
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". | ||
|
||
|
||
PASS successfullyParsed is true | ||
|
||
TEST COMPLETE | ||
|
10 changes: 10 additions & 0 deletions
10
LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> | ||
<html> | ||
<head> | ||
<script src="../resources/js-test-pre.js"></script> | ||
</head> | ||
<body> | ||
<script src="script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js"></script> | ||
<script src="../resources/js-test-post.js"></script> | ||
</body> | ||
</html> |
38 changes: 38 additions & 0 deletions
38
...tTests/js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,38 @@ | ||
description( | ||
"This tests that DFG generated code speculating SlowPutArrayStorageShape doesn't crash when seeing fast ArrayStorageShapes." | ||
); | ||
|
||
var slowPutArrayStorageArray = [ "slow" ]; | ||
var fastArrayStorageArray = [ "fast" ]; | ||
fastArrayStorageArray[1000] = 50; | ||
|
||
var o = { a: 10 }; | ||
Object.defineProperties(o, { | ||
"0": { | ||
set: function(x) { this.a = x; }, | ||
}, | ||
}); | ||
|
||
slowPutArrayStorageArray.__proto__ = o; | ||
|
||
function foo(a, isFast) { | ||
var result = 10; | ||
if (!a) | ||
return result; | ||
|
||
var doStuff = a[0] && isFast; | ||
if (doStuff) | ||
result = a[0] + 10; | ||
return result; | ||
} | ||
|
||
function test() { | ||
for (var k = 0; k < 5000; k++) { | ||
foo(slowPutArrayStorageArray, false); | ||
foo(fastArrayStorageArray, true); | ||
} | ||
} | ||
|
||
test(); | ||
|
||
var successfullyParsed = true; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters