19400 2008-06-04 21:48:33 -0700 subscript operator does not protect base when necessary 2008-06-05 02:21:58 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED HasReduction, Regression P2 Normal --- 1 oliver webkit-unassigned ggaren mjs zwarich oldest_to_newest 82324 0 oliver 2008-06-04 21:48:33 -0700 in the expression var a = [-1]; print(a[++a]) the result should be '0', but instead is 'undefined', as the code emitted does pre_inc a get_by_val result, a, a ... but should actually do mov temp, a pre_inc a get_by_val result, temp, a The issue is that we don't guard the base against potential modification by the subscript expression 82336 1 21506 zwarich 2008-06-05 01:50:17 -0700 Created attachment 21506 Proposed patch Here's a fix. It is a slight progression on SunSpider for me, and it doesn't affect very much codegen. I can post the diffs if anyone is interested. 82337 2 21506 mjs 2008-06-05 01:55:45 -0700 Comment on attachment 21506 Proposed patch r=me but I suggest more tests of funny business in the bracket subscript. 82339 3 zwarich 2008-06-05 02:21:58 -0700 Landed in r34373. 21506 2008-06-05 01:50:17 -0700 2008-06-05 01:55:45 -0700 Proposed patch temp.diff text/plain 7284 zwarich SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDM0MzcyKQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTkgQEAKKzIwMDgtMDYtMDUgIENhbWVyb24g WndhcmljaCAgPGN3endhcmljaEB1d2F0ZXJsb28uY2E+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQnVnIDE5NDAwOiBzdWJzY3JpcHQgb3BlcmF0b3Ig ZG9lcyBub3QgcHJvdGVjdCBiYXNlIHdoZW4gbmVjZXNzYXJ5CisgICAgICAgIDxodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk0MDA+CisKKyAgICAgICAgVXNlIGEgdGVt cG9yYXJ5IGZvciB0aGUgYmFzZSBpbiBCcmFja2V0QWNjZXNzb3JOb2RlIGlmIHRoZSBzdWJzY3Jp cHQKKyAgICAgICAgbWlnaHQgcG9zc2libHkgbW9kaWZ5IGl0LgorCisgICAgICAgICoga2pzL2dy YW1tYXIueToKKyAgICAgICAgKiBranMvbm9kZXMuY3BwOgorICAgICAgICAoS0pTOjpCcmFja2V0 QWNjZXNzb3JOb2RlOjplbWl0Q29kZSk6CisgICAgICAgICoga2pzL25vZGVzLmg6CisgICAgICAg IChLSlM6OkJyYWNrZXRBY2Nlc3Nvck5vZGU6Oik6CisKIDIwMDgtMDYtMDQgIFNhbSBXZWluaWcg IDxzYW1Ad2Via2l0Lm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBNYWNpZWogU3RhY2hvd2lh ay4KSW5kZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9ncmFtbWFyLnkKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSmF2 YVNjcmlwdENvcmUva2pzL2dyYW1tYXIueQkocmV2aXNpb24gMzQzNzIpCisrKyBKYXZhU2NyaXB0 Q29yZS9ranMvZ3JhbW1hci55CSh3b3JraW5nIGNvcHkpCkBAIC0zNjEsMTQgKzM2MSwxNCBAQCBF bGlzaW9uOgogTWVtYmVyRXhwcjoKICAgICBQcmltYXJ5RXhwcgogICB8IEZ1bmN0aW9uRXhwciAg ICAgICAgICAgICAgICAgICAgICAgIHsgJCQgPSBjcmVhdGVOb2RlRmVhdHVyZUluZm88RXhwcmVz c2lvbk5vZGUqPigkMS5tX25vZGUsICQxLm1fZmVhdHVyZUluZm8pOyB9Ci0gIHwgTWVtYmVyRXhw ciAnWycgRXhwciAnXScgICAgICAgICAgICAgeyAkJCA9IGNyZWF0ZU5vZGVGZWF0dXJlSW5mbzxF eHByZXNzaW9uTm9kZSo+KG5ldyBCcmFja2V0QWNjZXNzb3JOb2RlKCQxLm1fbm9kZSwgJDMubV9u b2RlKSwgJDEubV9mZWF0dXJlSW5mbyB8ICQzLm1fZmVhdHVyZUluZm8pOyB9CisgIHwgTWVtYmVy RXhwciAnWycgRXhwciAnXScgICAgICAgICAgICAgeyAkJCA9IGNyZWF0ZU5vZGVGZWF0dXJlSW5m bzxFeHByZXNzaW9uTm9kZSo+KG5ldyBCcmFja2V0QWNjZXNzb3JOb2RlKCQxLm1fbm9kZSwgJDMu bV9ub2RlLCAkMy5tX2ZlYXR1cmVJbmZvICYgQXNzaWduRmVhdHVyZSksICQxLm1fZmVhdHVyZUlu Zm8gfCAkMy5tX2ZlYXR1cmVJbmZvKTsgfQogICB8IE1lbWJlckV4cHIgJy4nIElERU5UICAgICAg ICAgICAgICAgIHsgJCQgPSBjcmVhdGVOb2RlRmVhdHVyZUluZm88RXhwcmVzc2lvbk5vZGUqPihu ZXcgRG90QWNjZXNzb3JOb2RlKCQxLm1fbm9kZSwgKiQzKSwgJDEubV9mZWF0dXJlSW5mbyk7IH0K ICAgfCBORVcgTWVtYmVyRXhwciBBcmd1bWVudHMgICAgICAgICAgICB7ICQkID0gY3JlYXRlTm9k ZUZlYXR1cmVJbmZvPEV4cHJlc3Npb25Ob2RlKj4obmV3IE5ld0V4cHJOb2RlKCQyLm1fbm9kZSwg JDMubV9ub2RlKSwgJDIubV9mZWF0dXJlSW5mbyB8ICQzLm1fZmVhdHVyZUluZm8pOyB9CiA7CiAK IE1lbWJlckV4cHJOb0JGOgogICAgIFByaW1hcnlFeHByTm9CcmFjZQotICB8IE1lbWJlckV4cHJO b0JGICdbJyBFeHByICddJyAgICAgICAgIHsgJCQgPSBjcmVhdGVOb2RlRmVhdHVyZUluZm88RXhw cmVzc2lvbk5vZGUqPihuZXcgQnJhY2tldEFjY2Vzc29yTm9kZSgkMS5tX25vZGUsICQzLm1fbm9k ZSksICQxLm1fZmVhdHVyZUluZm8gfCAkMy5tX2ZlYXR1cmVJbmZvKTsgfQorICB8IE1lbWJlckV4 cHJOb0JGICdbJyBFeHByICddJyAgICAgICAgIHsgJCQgPSBjcmVhdGVOb2RlRmVhdHVyZUluZm88 RXhwcmVzc2lvbk5vZGUqPihuZXcgQnJhY2tldEFjY2Vzc29yTm9kZSgkMS5tX25vZGUsICQzLm1f bm9kZSwgJDMubV9mZWF0dXJlSW5mbyAmIEFzc2lnbkZlYXR1cmUpLCAkMS5tX2ZlYXR1cmVJbmZv IHwgJDMubV9mZWF0dXJlSW5mbyk7IH0KICAgfCBNZW1iZXJFeHByTm9CRiAnLicgSURFTlQgICAg ICAgICAgICB7ICQkID0gY3JlYXRlTm9kZUZlYXR1cmVJbmZvPEV4cHJlc3Npb25Ob2RlKj4obmV3 IERvdEFjY2Vzc29yTm9kZSgkMS5tX25vZGUsICokMyksICQxLm1fZmVhdHVyZUluZm8pOyB9CiAg IHwgTkVXIE1lbWJlckV4cHIgQXJndW1lbnRzICAgICAgICAgICAgeyAkJCA9IGNyZWF0ZU5vZGVG ZWF0dXJlSW5mbzxFeHByZXNzaW9uTm9kZSo+KG5ldyBOZXdFeHByTm9kZSgkMi5tX25vZGUsICQz Lm1fbm9kZSksICQyLm1fZmVhdHVyZUluZm8gfCAkMy5tX2ZlYXR1cmVJbmZvKTsgfQogOwpAQCAt Mzg2LDE0ICszODYsMTQgQEAgTmV3RXhwck5vQkY6CiBDYWxsRXhwcjoKICAgICBNZW1iZXJFeHBy IEFyZ3VtZW50cyAgICAgICAgICAgICAgICB7ICQkID0gbWFrZUZ1bmN0aW9uQ2FsbE5vZGUoJDEs ICQyKTsgfQogICB8IENhbGxFeHByIEFyZ3VtZW50cyAgICAgICAgICAgICAgICAgIHsgJCQgPSBt YWtlRnVuY3Rpb25DYWxsTm9kZSgkMSwgJDIpOyB9Ci0gIHwgQ2FsbEV4cHIgJ1snIEV4cHIgJ10n ICAgICAgICAgICAgICAgeyAkJCA9IGNyZWF0ZU5vZGVGZWF0dXJlSW5mbzxFeHByZXNzaW9uTm9k ZSo+KG5ldyBCcmFja2V0QWNjZXNzb3JOb2RlKCQxLm1fbm9kZSwgJDMubV9ub2RlKSwgJDEubV9m ZWF0dXJlSW5mbyB8ICQzLm1fZmVhdHVyZUluZm8pOyB9CisgIHwgQ2FsbEV4cHIgJ1snIEV4cHIg J10nICAgICAgICAgICAgICAgeyAkJCA9IGNyZWF0ZU5vZGVGZWF0dXJlSW5mbzxFeHByZXNzaW9u Tm9kZSo+KG5ldyBCcmFja2V0QWNjZXNzb3JOb2RlKCQxLm1fbm9kZSwgJDMubV9ub2RlLCAkMy5t X2ZlYXR1cmVJbmZvICYgQXNzaWduRmVhdHVyZSksICQxLm1fZmVhdHVyZUluZm8gfCAkMy5tX2Zl YXR1cmVJbmZvKTsgfQogICB8IENhbGxFeHByICcuJyBJREVOVCAgICAgICAgICAgICAgICAgIHsg JCQgPSBjcmVhdGVOb2RlRmVhdHVyZUluZm88RXhwcmVzc2lvbk5vZGUqPihuZXcgRG90QWNjZXNz b3JOb2RlKCQxLm1fbm9kZSwgKiQzKSwgJDEubV9mZWF0dXJlSW5mbyk7IH0KIDsKIAogQ2FsbEV4 cHJOb0JGOgogICAgIE1lbWJlckV4cHJOb0JGIEFyZ3VtZW50cyAgICAgICAgICAgIHsgJCQgPSBt YWtlRnVuY3Rpb25DYWxsTm9kZSgkMSwgJDIpOyB9CiAgIHwgQ2FsbEV4cHJOb0JGIEFyZ3VtZW50 cyAgICAgICAgICAgICAgeyAkJCA9IG1ha2VGdW5jdGlvbkNhbGxOb2RlKCQxLCAkMik7IH0KLSAg fCBDYWxsRXhwck5vQkYgJ1snIEV4cHIgJ10nICAgICAgICAgICB7ICQkID0gY3JlYXRlTm9kZUZl YXR1cmVJbmZvPEV4cHJlc3Npb25Ob2RlKj4obmV3IEJyYWNrZXRBY2Nlc3Nvck5vZGUoJDEubV9u b2RlLCAkMy5tX25vZGUpLCAkMS5tX2ZlYXR1cmVJbmZvIHwgJDMubV9mZWF0dXJlSW5mbyk7IH0K KyAgfCBDYWxsRXhwck5vQkYgJ1snIEV4cHIgJ10nICAgICAgICAgICB7ICQkID0gY3JlYXRlTm9k ZUZlYXR1cmVJbmZvPEV4cHJlc3Npb25Ob2RlKj4obmV3IEJyYWNrZXRBY2Nlc3Nvck5vZGUoJDEu bV9ub2RlLCAkMy5tX25vZGUsICQzLm1fZmVhdHVyZUluZm8gJiBBc3NpZ25GZWF0dXJlKSwgJDEu bV9mZWF0dXJlSW5mbyB8ICQzLm1fZmVhdHVyZUluZm8pOyB9CiAgIHwgQ2FsbEV4cHJOb0JGICcu JyBJREVOVCAgICAgICAgICAgICAgeyAkJCA9IGNyZWF0ZU5vZGVGZWF0dXJlSW5mbzxFeHByZXNz aW9uTm9kZSo+KG5ldyBEb3RBY2Nlc3Nvck5vZGUoJDEubV9ub2RlLCAqJDMpLCAkMS5tX2ZlYXR1 cmVJbmZvKTsgfQogOwogCkluZGV4OiBKYXZhU2NyaXB0Q29yZS9ranMvbm9kZXMuY3BwCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIEphdmFTY3JpcHRDb3JlL2tqcy9ub2Rlcy5jcHAJKHJldmlzaW9uIDM0MzcyKQor KysgSmF2YVNjcmlwdENvcmUva2pzL25vZGVzLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNDA5LDcg KzQwOSw3IEBAIFJlZ2lzdGVySUQqIFByb3BlcnR5TGlzdE5vZGU6OmVtaXRDb2RlKEMKIAogUmVn aXN0ZXJJRCogQnJhY2tldEFjY2Vzc29yTm9kZTo6ZW1pdENvZGUoQ29kZUdlbmVyYXRvciYgZ2Vu ZXJhdG9yLCBSZWdpc3RlcklEKiBkc3QpCiB7Ci0gICAgUmVmUHRyPFJlZ2lzdGVySUQ+IGJhc2Ug PSBnZW5lcmF0b3IuZW1pdE5vZGUobV9iYXNlLmdldCgpKTsKKyAgICBSZWZQdHI8UmVnaXN0ZXJJ RD4gYmFzZSA9IGdlbmVyYXRvci5lbWl0Tm9kZUZvckxlZnRIYW5kU2lkZShtX2Jhc2UuZ2V0KCks IG1fc3Vic2NyaXB0SGFzQXNzaWdubWVudHMpOwogICAgIFJlZ2lzdGVySUQqIHByb3BlcnR5ID0g Z2VuZXJhdG9yLmVtaXROb2RlKG1fc3Vic2NyaXB0LmdldCgpKTsKIAogICAgIHJldHVybiBnZW5l cmF0b3IuZW1pdEdldEJ5VmFsKGdlbmVyYXRvci5maW5hbERlc3RpbmF0aW9uKGRzdCksIGJhc2Uu Z2V0KCksIHByb3BlcnR5KTsKSW5kZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9ub2Rlcy5oCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIEphdmFTY3JpcHRDb3JlL2tqcy9ub2Rlcy5oCShyZXZpc2lvbiAzNDM3MikKKysr IEphdmFTY3JpcHRDb3JlL2tqcy9ub2Rlcy5oCSh3b3JraW5nIGNvcHkpCkBAIC01MjcsOSArNTI3 LDEwIEBAIG5hbWVzcGFjZSBLSlMgewogCiAgICAgY2xhc3MgQnJhY2tldEFjY2Vzc29yTm9kZSA6 IHB1YmxpYyBFeHByZXNzaW9uTm9kZSB7CiAgICAgcHVibGljOgotICAgICAgICBCcmFja2V0QWNj ZXNzb3JOb2RlKEV4cHJlc3Npb25Ob2RlKiBiYXNlLCBFeHByZXNzaW9uTm9kZSogc3Vic2NyaXB0 KSBLSlNfRkFTVF9DQUxMCisgICAgICAgIEJyYWNrZXRBY2Nlc3Nvck5vZGUoRXhwcmVzc2lvbk5v ZGUqIGJhc2UsIEV4cHJlc3Npb25Ob2RlKiBzdWJzY3JpcHQsIGJvb2wgc3Vic2NyaXB0SGFzQXNz aWdubWVudHMpIEtKU19GQVNUX0NBTEwKICAgICAgICAgICAgIDogbV9iYXNlKGJhc2UpCiAgICAg ICAgICAgICAsIG1fc3Vic2NyaXB0KHN1YnNjcmlwdCkKKyAgICAgICAgICAgICwgbV9zdWJzY3Jp cHRIYXNBc3NpZ25tZW50cyhzdWJzY3JpcHRIYXNBc3NpZ25tZW50cykKICAgICAgICAgewogICAg ICAgICB9CiAKQEAgLTU0Niw2ICs1NDcsNyBAQCBuYW1lc3BhY2UgS0pTIHsKICAgICBwcml2YXRl OgogICAgICAgICBSZWZQdHI8RXhwcmVzc2lvbk5vZGU+IG1fYmFzZTsKICAgICAgICAgUmVmUHRy PEV4cHJlc3Npb25Ob2RlPiBtX3N1YnNjcmlwdDsKKyAgICAgICAgYm9vbCBtX3N1YnNjcmlwdEhh c0Fzc2lnbm1lbnRzOwogICAgIH07CiAKICAgICBjbGFzcyBEb3RBY2Nlc3Nvck5vZGUgOiBwdWJs aWMgRXhwcmVzc2lvbk5vZGUgewpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMzQzNzIpCisrKyBMYXlvdXRU ZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNSBAQAorMjAwOC0wNi0w NSAgQ2FtZXJvbiBad2FyaWNoICA8Y3d6d2FyaWNoQHV3YXRlcmxvby5jYT4KKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0cyBmb3I6CisKKyAgICAg ICAgQnVnIDE5NDAwOiBzdWJzY3JpcHQgb3BlcmF0b3IgZG9lcyBub3QgcHJvdGVjdCBiYXNlIHdo ZW4gbmVjZXNzYXJ5CisgICAgICAgIDxodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTk0MDA+CisKKyAgICAgICAgKiBmYXN0L2pzL2NvZGVnZW4tdGVtcG9yYXJpZXMtZXhw ZWN0ZWQudHh0OgorICAgICAgICAqIGZhc3QvanMvcmVzb3VyY2VzL2NvZGVnZW4tdGVtcG9yYXJp ZXMuanM6CisKIDIwMDgtMDYtMDQgIERhbiBCZXJuc3RlaW4gIDxtaXR6QGFwcGxlLmNvbT4KIAog ICAgICAgICBSZXZpZXdlZCBieSBEYXZlIEh5YXR0LgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9q cy9jb2RlZ2VuLXRlbXBvcmFyaWVzLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRU ZXN0cy9mYXN0L2pzL2NvZGVnZW4tdGVtcG9yYXJpZXMtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAz NDM3MikKKysrIExheW91dFRlc3RzL2Zhc3QvanMvY29kZWdlbi10ZW1wb3Jhcmllcy1leHBlY3Rl ZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTUsNiArNSw3IEBAIE9uIHN1Y2Nlc3MsIHlvdSB3aWxs IHNlZSBhIHNlcmllcyBvZiAiUEEKIAogUEFTUyBhIGlzIHRydWUKIFBBU1MgYiBpcyBmYWxzZQor UEFTUyBkIGlzIC0xCiBQQVNTIGFzc2lnbl90ZXN0MSgpIGlzICdQQVNTJwogUEFTUyBhc3NpZ25f dGVzdDIoKSBpcyAnUEFTUycKIFBBU1MgYXNzaWduX3Rlc3QzKCkgaXMgJ1BBU1MnCkluZGV4OiBM YXlvdXRUZXN0cy9mYXN0L2pzL3Jlc291cmNlcy9jb2RlZ2VuLXRlbXBvcmFyaWVzLmpzCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvanMvcmVzb3VyY2VzL2NvZGVnZW4tdGVtcG9yYXJp ZXMuanMJKHJldmlzaW9uIDM0MzcyKQorKysgTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNvdXJjZXMv Y29kZWdlbi10ZW1wb3Jhcmllcy5qcwkod29ya2luZyBjb3B5KQpAQCAtMTAsNiArMTAsMTEgQEAg dmFyIGIgPSBmYWxzZTsKIGIgPSB0cnVlICYmIGI7CiBzaG91bGRCZUZhbHNlKCJiIik7CiAKK3Zh ciBjID0gWy0xXTsKK3ZhciBkID0gY1srK2NdOworCitzaG91bGRCZSgiZCIsICItMSIpOworCiBm dW5jdGlvbiBUZXN0T2JqZWN0KCkgewogICAgIHRoaXMudG9TdHJpbmcgPSBmdW5jdGlvbigpIHsg cmV0dXJuIHRoaXMudGVzdDsgfQogICAgIHRoaXMudGVzdCA9ICJGQUlMIjsK