JSTests/ChangeLog

 12018-01-29 Michael Saboff <msaboff@apple.com>
 2
 3 REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
 4 https://bugs.webkit.org/show_bug.cgi?id=182249
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 New regression test.
 9
 10 * stress/compare-clobber-untypeduse.js: Added.
 11
1122018-01-29 Matt Lewis <jlewis3@apple.com>
213
314 Unreviewed, rolling out r227725.
227739

JSTests/stress/compare-clobber-untypeduse.js

 1// Test that we properly clobber untyped uses. This test should throw or crash.
 2
 3let val;
 4
 5for (var i = 0; i < 100000; i++)
 6 val = 42;
 7
 8for (let i = 0; i < 1e6; i++) {
 9 if (val != null && val == 2) {
 10 throw "Val should be 42, but is 2";
 11 }
 12}
nonexistent

Source/JavaScriptCore/ChangeLog

 12018-01-29 Michael Saboff <msaboff@apple.com>
 2
 3 REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
 4 https://bugs.webkit.org/show_bug.cgi?id=182249
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Changed clobberize() handling of CompareEq, et al to properly handle comparisons between
 9 Untyped and Object values when compared against built in types. Such comparisons can
 10 invoke toNumber() or other methods.
 11
 12 * dfg/DFGClobberize.h:
 13 (JSC::DFG::clobberize):
 14
1152018-01-29 Matt Lewis <jlewis3@apple.com>
216
317 Unreviewed, rolling out r227725.
227739

Source/JavaScriptCore/dfg/DFGClobberize.h

@@void clobberize(Graph& graph, Node* node
15451545 write(HeapObjectCount);
15461546 return;
15471547 }
1548  if (!node->isBinaryUseKind(UntypedUse)) {
1549  def(PureValue(node));
 1548
 1549 if (node->child1().useKind() == UntypedUse || node->child1().useKind() == ObjectUse
 1550 || node->child2().useKind() == UntypedUse || node->child2().useKind() == ObjectUse) {
 1551 read(World);
 1552 write(Heap);
15501553 return;
15511554 }
1552  read(World);
1553  write(Heap);
 1555
 1556 def(PureValue(node));
15541557 return;
15551558
15561559 case ToNumber: {
227739