Attachment 100867 Details for Bug 64562 – the patch

[patch] the patch

fixassert_patch_1.diff (text/plain), 4.14 KB, created by Filip Pizlo on 2011-07-14 14:52:15 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2011-07-14 14:52:15 PDT

Size: 4.14 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 91028)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2011-07-14  Filip Pizlo  <fpizlo@apple.com>
>+
>+        DFG JIT crashes on host constructor calls in debug mode.
>+        https://bugs.webkit.org/show_bug.cgi?id=64562
>+        
>+        Reviewed by NOBODY (OOPS!).
>+        
>+        Fixed the relevant ASSERT.
>+
>+        * dfg/DFGOperations.cpp:
>+
> 2011-07-14  Filip Pizlo  <fpizlo@apple.com>
> 
>         DFG speculative JIT contains a FIXME for rewinding speculative code generation that
>Index: Source/JavaScriptCore/dfg/DFGOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.cpp	(revision 91025)
>+++ Source/JavaScriptCore/dfg/DFGOperations.cpp	(working copy)
>@@ -477,7 +477,7 @@ static void* handleHostCall(ExecState* e
>         ConstructData constructData;
>         ConstructType constructType = getConstructData(callee, constructData);
>         
>-        ASSERT(constructType = ConstructTypeJS);
>+        ASSERT(constructType != ConstructTypeJS);
>         
>         if (constructType == ConstructTypeHost) {
>             if (!globalData->interpreter->registerFile().grow(execCallee->registers())) {
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 91028)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,18 @@
>+2011-07-14  Filip Pizlo  <fpizlo@apple.com>
>+
>+        DFG JIT crashes on host constructor calls in debug mode.
>+        https://bugs.webkit.org/show_bug.cgi?id=64562
>+
>+        Reviewed by NOBODY (OOPS!).
>+        
>+        This bug snuck past our tests, so this patchs adds a test to cover this
>+        case.
>+
>+        * fast/js/array-constructor-host-call-expected.txt: Added.
>+        * fast/js/array-constructor-host-call.html: Added.
>+        * fast/js/script-tests/array-constructor-host-call.js: Added.
>+        (constructArray):
>+
> 2011-07-14  Vincent Scheib  <scheib@chromium.org>
> 
>         [chromium] updated test expectations.
>Index: LayoutTests/fast/js/array-constructor-host-call-expected.txt
>===================================================================
>--- LayoutTests/fast/js/array-constructor-host-call-expected.txt	(revision 0)
>+++ LayoutTests/fast/js/array-constructor-host-call-expected.txt	(revision 0)
>@@ -0,0 +1,15 @@
>+This tests that array construction via a host call works.
>+
>+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>+
>+
>+PASS array instanceof Array is true
>+PASS array.length is 100
>+PASS array instanceof Array is true
>+PASS array.length is 100
>+PASS array instanceof Array is true
>+PASS array.length is 100
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>Index: LayoutTests/fast/js/array-constructor-host-call.html
>===================================================================
>--- LayoutTests/fast/js/array-constructor-host-call.html	(revision 0)
>+++ LayoutTests/fast/js/array-constructor-host-call.html	(revision 0)
>@@ -0,0 +1,13 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<link rel="stylesheet" href="resources/js-test-style.css">
>+<script src="resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<p id="description"></p>
>+<div id="console"></div>
>+<script src="script-tests/array-constructor-host-call.js"></script>
>+<script src="resources/js-test-post.js"></script>
>+</body>
>+</html>
>Index: LayoutTests/fast/js/script-tests/array-constructor-host-call.js
>===================================================================
>--- LayoutTests/fast/js/script-tests/array-constructor-host-call.js	(revision 0)
>+++ LayoutTests/fast/js/script-tests/array-constructor-host-call.js	(revision 0)
>@@ -0,0 +1,15 @@
>+description(
>+"This tests that array construction via a host call works."
>+);
>+
>+function constructArray(arrayConstructor) {
>+    return new arrayConstructor(100);
>+}
>+
>+for (var i = 0; i < 3; ++i) {
>+    var array = constructArray(Array);
>+    shouldBeTrue("array instanceof Array");
>+    shouldBe("array.length", "100");
>+}
>+
>+var successfullyParsed = true;

Actions: View | Formatted Diff | Diff

Attachments on bug 64562: 100867