192441 2018-12-05 17:21:42 -0800 speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar. 2018-12-05 20:34:36 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam commit-queue fpizlo keith_miller msaboff rmorisset saam tzagallo webkit-bug-importer oldest_to_newest 1485520 0 mark.lam 2018-12-05 17:21:42 -0800 This is because a regular String (non-Identifier) can be converted into an Identifier. During DFG/FTL compilation, AbstractValue::checkConsistency() may expect a value to be of type SpecStringVar, but the mutator thread may have converted the string into an Identifier. This creates a race where AbstractValue::checkConsistency() may fail because it sees a SpecStringIdent when it expects the a SpecStringVar. The fix is to speculate non-Identifier strings as type SpecString which allows it to be SpecStringVar or SpecStringIndent. <rdar://problem/46480355> 1485523 1 356684 mark.lam 2018-12-05 17:36:21 -0800 Created attachment 356684 proposed patch. 1485594 2 356684 mark.lam 2018-12-05 20:09:03 -0800 Comment on attachment 356684 proposed patch. Thanks for the review. Landing now. 1485599 3 356684 commit-queue 2018-12-05 20:34:35 -0800 Comment on attachment 356684 proposed patch. Clearing flags on attachment: 356684 Committed r238923: <https://trac.webkit.org/changeset/238923> 1485600 4 commit-queue 2018-12-05 20:34:36 -0800 All reviewed patches have been landed. Closing bug. 356684 2018-12-05 17:36:21 -0800 2018-12-05 20:34:35 -0800 proposed patch. bug-192441.patch text/plain 3401 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMzg5MTgpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEzIEBACisyMDE4LTEyLTA1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBzcGVjdWxhdGlvbkZyb21DZWxsKCkgc2hvdWxkIHNwZWN1bGF0ZSBub24t SWRlbnRpZmllciBzdHJpbmdzIGFzIFNwZWNTdHJpbmcgaW5zdGVhZCBvZiBTcGVjU3RyaW5nVmFy LgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTkyNDQx CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS80NjQ4MDM1NT4KKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIHN0cmVzcy9yZWdyZXNzLTE5MjQ0MS5qczog QWRkZWQuCisKIDIwMTgtMTItMDQgIE1hcmsgTGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgogCiAg ICAgICAgIERGRydzIFN0cmVuZ3RoUmVkdWN0aW9uIHBoYXNlIHNob3VsZCBub3QgcmVkdWNlIENv bnN0cnVjdCBpbnRvIERpcmVjdENvbnRydWN0IHdoZW4gdGhlIGV4ZWN1dGFibGUgZG9lcyBub3Qg aGF2ZSBjb25zdHJ1Y3RBYmlsaXR5LgpJbmRleDogSlNUZXN0cy9zdHJlc3MvcmVncmVzcy0xOTI0 NDEuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvcmVncmVzcy0xOTI0NDEuanMJKG5v bmV4aXN0ZW50KQorKysgSlNUZXN0cy9zdHJlc3MvcmVncmVzcy0xOTI0NDEuanMJKHdvcmtpbmcg Y29weSkKQEAgLTAsMCArMSwxMiBAQAorLy9AIHJlcXVpcmVPcHRpb25zKCItLWppdFBvbGljeVNj YWxlPTAiKQorCisvLyBUaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLgorCits ZXQgeCA9IHt9CitsZXQgZW5VUyA9IFsnZW4nLCAnVVMnXS5qb2luKCctJykKK2ZvciAobGV0IGk9 MDsgaTwxMDA7IGkrKykgeworICAgIEludGwuTnVtYmVyRm9ybWF0KGVuVVMpCit9Citmb3IgKGxl dCBpPTA7IGk8MTAwMDA7IGkrKykgeworICAgIHhbZW5VU10KK307CkluZGV4OiBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIzODkxNikKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9D aGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwyNCBAQAorMjAxOC0xMi0wNSAgTWFy ayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CisKKyAgICAgICAgc3BlY3VsYXRpb25Gcm9tQ2Vs bCgpIHNob3VsZCBzcGVjdWxhdGUgbm9uLUlkZW50aWZpZXIgc3RyaW5ncyBhcyBTcGVjU3RyaW5n IGluc3RlYWQgb2YgU3BlY1N0cmluZ1Zhci4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTE5MjQ0MQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNDY0ODAz NTU+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhp cyBpcyBiZWNhdXNlIGEgcmVndWxhciBTdHJpbmcgKG5vbi1JZGVudGlmaWVyKSBjYW4gYmUgY29u dmVydGVkIGludG8gYW4KKyAgICAgICAgSWRlbnRpZmllci4gIER1cmluZyBERkcvRlRMIGNvbXBp bGF0aW9uLCBBYnN0cmFjdFZhbHVlOjpjaGVja0NvbnNpc3RlbmN5KCkgbWF5CisgICAgICAgIGV4 cGVjdCBhIHZhbHVlIHRvIGJlIG9mIHR5cGUgU3BlY1N0cmluZ1ZhciwgYnV0IHRoZSBtdXRhdG9y IHRocmVhZCBtYXkgaGF2ZQorICAgICAgICBjb252ZXJ0ZWQgdGhlIHN0cmluZyBpbnRvIGFuIElk ZW50aWZpZXIuICBUaGlzIGNyZWF0ZXMgYSByYWNlIHdoZXJlCisgICAgICAgIEFic3RyYWN0VmFs dWU6OmNoZWNrQ29uc2lzdGVuY3koKSBtYXkgZmFpbCBiZWNhdXNlIGl0IHNlZXMgYSBTcGVjU3Ry aW5nSWRlbnQgd2hlbgorICAgICAgICBpdCBleHBlY3RzIHRoZSBhIFNwZWNTdHJpbmdWYXIuICAK KworICAgICAgICBUaGUgZml4IGlzIHRvIHNwZWN1bGF0ZSBub24tSWRlbnRpZmllciBzdHJpbmdz IGFzIHR5cGUgU3BlY1N0cmluZyB3aGljaCBhbGxvd3MgaXQKKyAgICAgICAgdG8gYmUgU3BlY1N0 cmluZ1ZhciBvciBTcGVjU3RyaW5nSW5kZW50LgorCisgICAgICAgICogYnl0ZWNvZGUvU3BlY3Vs YXRlZFR5cGUuY3BwOgorICAgICAgICAoSlNDOjpzcGVjdWxhdGlvbkZyb21DZWxsKToKKwogMjAx OC0xMi0wNCAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CiAKICAgICAgICAgREZHJ3Mg U3RyZW5ndGhSZWR1Y3Rpb24gcGhhc2Ugc2hvdWxkIG5vdCByZWR1Y2UgQ29uc3RydWN0IGludG8g RGlyZWN0Q29udHJ1Y3Qgd2hlbiB0aGUgZXhlY3V0YWJsZSBkb2VzIG5vdCBoYXZlIGNvbnN0cnVj dEFiaWxpdHkuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvU3BlY3VsYXRl ZFR5cGUuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9T cGVjdWxhdGVkVHlwZS5jcHAJKHJldmlzaW9uIDIzODkxNikKKysrIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9ieXRlY29kZS9TcGVjdWxhdGVkVHlwZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTEsNSAr MSw1IEBACiAvKgotICogQ29weXJpZ2h0IChDKSAyMDExLTIwMTcgQXBwbGUgSW5jLiBBbGwgcmln aHRzIHJlc2VydmVkLgorICogQ29weXJpZ2h0IChDKSAyMDExLTIwMTggQXBwbGUgSW5jLiBBbGwg cmlnaHRzIHJlc2VydmVkLgogICoKICAqIFJlZGlzdHJpYnV0aW9uIGFuZCB1c2UgaW4gc291cmNl IGFuZCBiaW5hcnkgZm9ybXMsIHdpdGggb3Igd2l0aG91dAogICogbW9kaWZpY2F0aW9uLCBhcmUg cGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zCkBAIC00ODAs NyArNDgwLDcgQEAgU3BlY3VsYXRlZFR5cGUgc3BlY3VsYXRpb25Gcm9tQ2VsbChKU0NlbAogICAg ICAgICAgICAgaWYgKGltcGwtPmlzQXRvbWljKCkpCiAgICAgICAgICAgICAgICAgcmV0dXJuIFNw ZWNTdHJpbmdJZGVudDsKICAgICAgICAgfQotICAgICAgICByZXR1cm4gU3BlY1N0cmluZ1ZhcjsK KyAgICAgICAgcmV0dXJuIFNwZWNTdHJpbmc7CiAgICAgfQogICAgIHJldHVybiBzcGVjdWxhdGlv bkZyb21TdHJ1Y3R1cmUoY2VsbC0+c3RydWN0dXJlKCkpOwogfQo=