Attachment 370511 Details for Bug 198189 – Patch

[patch] Patch

bug-198189-20190523203608.patch (text/plain), 2.78 KB, created by Tadeu Zagallo on 2019-05-23 11:36:10 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Tadeu Zagallo

Created: 2019-05-23 11:36:10 PDT

Size: 2.78 KB

patch

obsolete

>Subversion Revision: 245700
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 097a2cff8479aa8bd384fd2ff312dbb824dc9b66..51babcf34749a2ec0f6b52e7d320526f8e7e9de9 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,16 @@
>+2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
>+
>+        DFG::OSREntry should perform arity check
>+        https://bugs.webkit.org/show_bug.cgi?id=198189
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        The check prevents OSR entering from hot loops inside functions that were called
>+        with too few arguments.
>+
>+        * dfg/DFGOSREntry.cpp:
>+        (JSC::DFG::prepareOSREntry):
>+
> 2019-05-23  Ross Kirsling  <ross.kirsling@sony.com>
> 
>         Lexer<T>::parseDecimal ought to ASSERT isASCIIDigit
>diff --git a/Source/JavaScriptCore/dfg/DFGOSREntry.cpp b/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
>index a7f0506c4f1159d4141b9a4254ea88dfea459d47..d0e527c2cbe88708d1acc71ab7fe39c447134ad4 100644
>--- a/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
>@@ -177,15 +177,6 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
>     //    OSR at this time.
>     
>     for (size_t argument = 0; argument < entry->m_expectedValues.numberOfArguments(); ++argument) {
>-        if (argument >= exec->argumentCountIncludingThis()) {
>-            if (Options::verboseOSR()) {
>-                dataLogF("    OSR failed because argument %zu was not passed, expected ", argument);
>-                entry->m_expectedValues.argument(argument).dump(WTF::dataFile());
>-                dataLogF(".\n");
>-            }
>-            return nullptr;
>-        }
>-        
>         JSValue value;
>         if (!argument)
>             value = exec->thisValue();
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 46c931ee71fef5f0dbf03b16c60cfe857eee2dbf..92bb8f97572dca7ca23e2953edcc46aaed714ec0 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
>+
>+        DFG::OSREntry should perform arity check
>+        https://bugs.webkit.org/show_bug.cgi?id=198189
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * microbenchmarks/loop-osr-with-arity-mismatch.js: Added.
>+        (foo):
>+
> 2019-05-23  Stephan Szabo  <stephan.szabo@sony.com>
> 
>         [PlayStation] Skip additional tests on PlayStation
>diff --git a/JSTests/microbenchmarks/loop-osr-with-arity-mismatch.js b/JSTests/microbenchmarks/loop-osr-with-arity-mismatch.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..e7eeac13732b3e59ec540f75fbef051f75bb89f1
>--- /dev/null
>+++ b/JSTests/microbenchmarks/loop-osr-with-arity-mismatch.js
>@@ -0,0 +1,6 @@
>+function foo(x, y) {
>+    for (var i = 0; i < 1e7; i++) {
>+        x[y] += i;
>+    }
>+}
>+foo({})

Actions: View | Formatted Diff | Diff

Attachments on bug 198189: 370511 | 370513