208764 2020-03-07 09:56:32 -0800 Remove bad assertion in FTLLowerDFGToB3's compileDelBy(). 2020-03-08 13:38:33 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam commit-queue ews-watchlist keith_miller msaboff saam tzagallo webkit-bug-importer oldest_to_newest 1627229 0 mark.lam 2020-03-07 09:56:32 -0800 The assertion ASSERT(base.gpr() != params[2].gpr()) is wrong because it is legal JS to pass in the same value as the base and subscript. <rdar://problem/59940095> 1627232 1 392864 mark.lam 2020-03-07 10:02:44 -0800 Created attachment 392864 proposed patch. 1627233 2 392864 mark.lam 2020-03-07 10:05:38 -0800 Comment on attachment 392864 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=392864&action=review > JSTests/stress/delete-by-val-with-base-and-subscript-using-same-cell.js:6 > +for (let i = 0; i < 1000000; i++) I'll reduce this count to 20000 before landing. That should be sufficient. > JSTests/stress/delete-by-val-with-base-and-subscript-using-same-non-cell.js:6 > +for (let i = 0; i < 1000000; i++) Ditto. 1627234 3 392865 mark.lam 2020-03-07 10:08:13 -0800 Created attachment 392865 proposed patch. 1627269 4 392865 keith_miller 2020-03-07 12:33:17 -0800 Comment on attachment 392865 proposed patch. r=me 1627281 5 392865 mark.lam 2020-03-07 13:12:51 -0800 Comment on attachment 392865 proposed patch. Thanks for the review. 1627303 6 392865 commit-queue 2020-03-07 13:56:49 -0800 Comment on attachment 392865 proposed patch. Clearing flags on attachment: 392865 Committed r258078: <https://trac.webkit.org/changeset/258078> 1627304 7 commit-queue 2020-03-07 13:56:51 -0800 All reviewed patches have been landed. Closing bug. 1627516 8 392865 saam 2020-03-08 10:10:25 -0700 Comment on attachment 392865 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=392865&action=review > Source/JavaScriptCore/ChangeLog:10 > + JS to pass in the same value as the base and subscript. The runtime will handle But does the inline cache handle it properly? 1627570 9 mark.lam 2020-03-08 13:38:33 -0700 (In reply to Saam Barati from comment #8) > Comment on attachment 392865 [details] > proposed patch. > > View in context: > https://bugs.webkit.org/attachment.cgi?id=392865&action=review > > > Source/JavaScriptCore/ChangeLog:10 > > + JS to pass in the same value as the base and subscript. The runtime will handle > > But does the inline cache handle it properly? Yes. When I said “runtime”, I meant the inline cache as well. 392864 2020-03-07 10:02:44 -0800 2020-03-07 10:08:13 -0800 proposed patch. bug-208764.patch text/plain 3234 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNTgwNzMpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE0IEBACisyMDIwLTAzLTA3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBSZW1vdmUgYmFkIGFzc2VydGlvbiBpbiBGVExMb3dlckRGR1RvQjMncyBj b21waWxlRGVsQnkoKS4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTIwODc2NAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNTk5NDAwOTU+CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3MvZGVsZXRl LWJ5LXZhbC13aXRoLWJhc2UtYW5kLXN1YnNjcmlwdC11c2luZy1zYW1lLWNlbGwuanM6IEFkZGVk LgorICAgICAgICAqIHN0cmVzcy9kZWxldGUtYnktdmFsLXdpdGgtYmFzZS1hbmQtc3Vic2NyaXB0 LXVzaW5nLXNhbWUtbm9uLWNlbGwuanM6IEFkZGVkLgorCiAyMDIwLTAzLTA2ICBZdXN1a2UgU3V6 dWtpICA8eXN1enVraUBhcHBsZS5jb20+CiAKICAgICAgICAgW0pTQ10gRW5hYmxlIHB1YmxpYyBj bGFzcyBmaWVsZHMKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2RlbGV0ZS1ieS12YWwtd2l0aC1iYXNl LWFuZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1jZWxsLmpzCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMv c3RyZXNzL2RlbGV0ZS1ieS12YWwtd2l0aC1iYXNlLWFuZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1j ZWxsLmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL2RlbGV0ZS1ieS12YWwtd2l0 aC1iYXNlLWFuZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1jZWxsLmpzCSh3b3JraW5nIGNvcHkpCkBA IC0wLDAgKzEsOCBAQAorZnVuY3Rpb24gZm9vKHgpIHsKKyAgICBkZWxldGUgeFt4XTsKK30KK25v SW5saW5lKGZvbyk7CisKK2ZvciAobGV0IGkgPSAwOyBpIDwgMTAwMDAwMDsgaSsrKQorICAgIGZv byh7fSk7CisKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2RlbGV0ZS1ieS12YWwtd2l0aC1iYXNlLWFu ZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1ub24tY2VsbC5qcwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3Rz L3N0cmVzcy9kZWxldGUtYnktdmFsLXdpdGgtYmFzZS1hbmQtc3Vic2NyaXB0LXVzaW5nLXNhbWUt bm9uLWNlbGwuanMJKG5vbmV4aXN0ZW50KQorKysgSlNUZXN0cy9zdHJlc3MvZGVsZXRlLWJ5LXZh bC13aXRoLWJhc2UtYW5kLXN1YnNjcmlwdC11c2luZy1zYW1lLW5vbi1jZWxsLmpzCSh3b3JraW5n IGNvcHkpCkBAIC0wLDAgKzEsOCBAQAorZnVuY3Rpb24gZm9vKHgpIHsKKyAgICBkZWxldGUgeFt4 XTsKK30KK25vSW5saW5lKGZvbyk7CisKK2ZvciAobGV0IGkgPSAwOyBpIDwgMTAwMDAwMDsgaSsr KQorICAgIGZvbyh0cnVlKTsKKwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxv Zwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCShyZXZpc2lv biAyNTgwNzMpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNv cHkpCkBAIC0xLDMgKzEsMTggQEAKKzIwMjAtMDMtMDcgIE1hcmsgTGFtICA8bWFyay5sYW1AYXBw bGUuY29tPgorCisgICAgICAgIFJlbW92ZSBiYWQgYXNzZXJ0aW9uIGluIEZUTExvd2VyREZHVG9C MydzIGNvbXBpbGVEZWxCeSgpLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MjA4NzY0CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS81OTk0MDA5NT4KKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGUgYXNzZXJ0 aW9uIEFTU0VSVChiYXNlLmdwcigpICE9IHBhcmFtc1syXS5ncHIoKSkgaXMgd3JvbmcgYmVjYXVz ZSBpdCBpcyBsZWdhbAorICAgICAgICBKUyB0byBwYXNzIGluIHRoZSBzYW1lIHZhbHVlIGFzIHRo ZSBiYXNlIGFuZCBzdWJzY3JpcHQuICBUaGUgcnVudGltZSB3aWxsIGhhbmRsZQorICAgICAgICBp dCBwcm9wZXJseS4KKworICAgICAgICAqIGZ0bC9GVExMb3dlckRGR1RvQjMuY3BwOgorICAgICAg ICAoSlNDOjpGVEw6OkRGRzo6TG93ZXJERkdUb0IzOjpjb21waWxlRGVsQnkpOgorCiAyMDIwLTAz LTA2ICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBhcHBsZS5jb20+CiAKICAgICAgICAgW0pTQ10g RW5hYmxlIHB1YmxpYyBjbGFzcyBmaWVsZHMKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9m dGwvRlRMTG93ZXJERkdUb0IzLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENv cmUvZnRsL0ZUTExvd2VyREZHVG9CMy5jcHAJKHJldmlzaW9uIDI1ODA3MykKKysrIFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9mdGwvRlRMTG93ZXJERkdUb0IzLmNwcAkod29ya2luZyBjb3B5KQpAQCAt NTE5NSw3ICs1MTk1LDYgQEAgcHJpdmF0ZToKICAgICAgICAgICAgICAgICAgICAgaWYgY29uc3Rl eHByIChraW5kID09IERlbEJ5S2luZDo6Tm9ybWFsKQogICAgICAgICAgICAgICAgICAgICAgICAg cmV0dXJuIENDYWxsSGVscGVyczo6VHJ1c3RlZEltbVB0cihzdWJzY3JpcHRWYWx1ZSk7CiAgICAg ICAgICAgICAgICAgICAgIGVsc2UgewotICAgICAgICAgICAgICAgICAgICAgICAgQVNTRVJUKGJh c2UuZ3ByKCkgIT0gcGFyYW1zWzJdLmdwcigpKTsKICAgICAgICAgICAgICAgICAgICAgICAgIEFT U0VSVChwYXJhbXMuZ3BTY3JhdGNoKDApICE9IHBhcmFtc1syXS5ncHIoKSk7CiAgICAgICAgICAg ICAgICAgICAgICAgICBpZiAobm9kZS0+Y2hpbGQyKCkudXNlS2luZCgpID09IFVudHlwZWRVc2Up CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2xvd0Nhc2VzLmFwcGVuZChqaXQuYnJhbmNo SWZOb3RDZWxsKEpTVmFsdWVSZWdzKHBhcmFtc1syXS5ncHIoKSkpKTsK 392865 2020-03-07 10:08:13 -0800 2020-03-07 13:56:49 -0800 proposed patch. bug-208764.patch text/plain 3230 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNTgwNzMpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE0IEBACisyMDIwLTAzLTA3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBSZW1vdmUgYmFkIGFzc2VydGlvbiBpbiBGVExMb3dlckRGR1RvQjMncyBj b21waWxlRGVsQnkoKS4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTIwODc2NAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNTk5NDAwOTU+CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3MvZGVsZXRl LWJ5LXZhbC13aXRoLWJhc2UtYW5kLXN1YnNjcmlwdC11c2luZy1zYW1lLWNlbGwuanM6IEFkZGVk LgorICAgICAgICAqIHN0cmVzcy9kZWxldGUtYnktdmFsLXdpdGgtYmFzZS1hbmQtc3Vic2NyaXB0 LXVzaW5nLXNhbWUtbm9uLWNlbGwuanM6IEFkZGVkLgorCiAyMDIwLTAzLTA2ICBZdXN1a2UgU3V6 dWtpICA8eXN1enVraUBhcHBsZS5jb20+CiAKICAgICAgICAgW0pTQ10gRW5hYmxlIHB1YmxpYyBj bGFzcyBmaWVsZHMKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2RlbGV0ZS1ieS12YWwtd2l0aC1iYXNl LWFuZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1jZWxsLmpzCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMv c3RyZXNzL2RlbGV0ZS1ieS12YWwtd2l0aC1iYXNlLWFuZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1j ZWxsLmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL2RlbGV0ZS1ieS12YWwtd2l0 aC1iYXNlLWFuZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1jZWxsLmpzCSh3b3JraW5nIGNvcHkpCkBA IC0wLDAgKzEsOCBAQAorZnVuY3Rpb24gZm9vKHgpIHsKKyAgICBkZWxldGUgeFt4XTsKK30KK25v SW5saW5lKGZvbyk7CisKK2ZvciAobGV0IGkgPSAwOyBpIDwgMjAwMDA7IGkrKykKKyAgICBmb28o e30pOworCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9kZWxldGUtYnktdmFsLXdpdGgtYmFzZS1hbmQt c3Vic2NyaXB0LXVzaW5nLXNhbWUtbm9uLWNlbGwuanMKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9z dHJlc3MvZGVsZXRlLWJ5LXZhbC13aXRoLWJhc2UtYW5kLXN1YnNjcmlwdC11c2luZy1zYW1lLW5v bi1jZWxsLmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL2RlbGV0ZS1ieS12YWwt d2l0aC1iYXNlLWFuZC1zdWJzY3JpcHQtdXNpbmctc2FtZS1ub24tY2VsbC5qcwkod29ya2luZyBj b3B5KQpAQCAtMCwwICsxLDggQEAKK2Z1bmN0aW9uIGZvbyh4KSB7CisgICAgZGVsZXRlIHhbeF07 Cit9Citub0lubGluZShmb28pOworCitmb3IgKGxldCBpID0gMDsgaSA8IDIwMDAwOyBpKyspCisg ICAgZm9vKHRydWUpOworCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI1 ODA3MykKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkK QEAgLTEsMyArMSwxOCBAQAorMjAyMC0wMy0wNyAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5j b20+CisKKyAgICAgICAgUmVtb3ZlIGJhZCBhc3NlcnRpb24gaW4gRlRMTG93ZXJERkdUb0IzJ3Mg Y29tcGlsZURlbEJ5KCkuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0yMDg3NjQKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzU5OTQwMDk1PgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBhc3NlcnRpb24g QVNTRVJUKGJhc2UuZ3ByKCkgIT0gcGFyYW1zWzJdLmdwcigpKSBpcyB3cm9uZyBiZWNhdXNlIGl0 IGlzIGxlZ2FsCisgICAgICAgIEpTIHRvIHBhc3MgaW4gdGhlIHNhbWUgdmFsdWUgYXMgdGhlIGJh c2UgYW5kIHN1YnNjcmlwdC4gIFRoZSBydW50aW1lIHdpbGwgaGFuZGxlCisgICAgICAgIGl0IHBy b3Blcmx5LgorCisgICAgICAgICogZnRsL0ZUTExvd2VyREZHVG9CMy5jcHA6CisgICAgICAgIChK U0M6OkZUTDo6REZHOjpMb3dlckRGR1RvQjM6OmNvbXBpbGVEZWxCeSk6CisKIDIwMjAtMDMtMDYg IFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBbSlNDXSBFbmFi bGUgcHVibGljIGNsYXNzIGZpZWxkcwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2Z0bC9G VExMb3dlckRGR1RvQjMuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9m dGwvRlRMTG93ZXJERkdUb0IzLmNwcAkocmV2aXNpb24gMjU4MDczKQorKysgU291cmNlL0phdmFT Y3JpcHRDb3JlL2Z0bC9GVExMb3dlckRGR1RvQjMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC01MTk1 LDcgKzUxOTUsNiBAQCBwcml2YXRlOgogICAgICAgICAgICAgICAgICAgICBpZiBjb25zdGV4cHIg KGtpbmQgPT0gRGVsQnlLaW5kOjpOb3JtYWwpCiAgICAgICAgICAgICAgICAgICAgICAgICByZXR1 cm4gQ0NhbGxIZWxwZXJzOjpUcnVzdGVkSW1tUHRyKHN1YnNjcmlwdFZhbHVlKTsKICAgICAgICAg ICAgICAgICAgICAgZWxzZSB7Ci0gICAgICAgICAgICAgICAgICAgICAgICBBU1NFUlQoYmFzZS5n cHIoKSAhPSBwYXJhbXNbMl0uZ3ByKCkpOwogICAgICAgICAgICAgICAgICAgICAgICAgQVNTRVJU KHBhcmFtcy5ncFNjcmF0Y2goMCkgIT0gcGFyYW1zWzJdLmdwcigpKTsKICAgICAgICAgICAgICAg ICAgICAgICAgIGlmIChub2RlLT5jaGlsZDIoKS51c2VLaW5kKCkgPT0gVW50eXBlZFVzZSkKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBzbG93Q2FzZXMuYXBwZW5kKGppdC5icmFuY2hJZk5v dENlbGwoSlNWYWx1ZVJlZ3MocGFyYW1zWzJdLmdwcigpKSkpOwo=