229493 2021-08-25 04:52:27 -0700 [JSC] Infinite loop in for...in after r280760 2021-08-25 11:49:27 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 xan.lopez webkit-unassigned ews-watchlist keith_miller mark.lam msaboff saam tzagallo webkit-bug-importer xan.lopez ysuzuki oldest_to_newest 1787141 0 xan.lopez 2021-08-25 04:52:27 -0700 This is at least observable in the JS LayoutTest reserved-words.js. The following fix seems to take care of it: diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp index 3940a4e9afd3..113a7d9e191e 100644 --- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp +++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp @@ -13440,6 +13440,7 @@ void SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode(Node* node) m_jit.or64(scratch.gpr(), resultRegs.payloadGPR()); #else m_jit.move(TrustedImm32(JSPropertyNameEnumerator::IndexedMode), resultRegs.tagGPR()); + m_jit.or32(scratch.gpr(), resultRegs.payloadGPR()); #endif jsValueResult(resultRegs, node); 1787142 1 436384 xan.lopez 2021-08-25 05:07:23 -0700 Created attachment 436384 v1 1787171 2 436390 xan.lopez 2021-08-25 08:10:22 -0700 Created attachment 436390 v2 1787223 3 436390 ysuzuki 2021-08-25 11:06:36 -0700 Comment on attachment 436390 v2 r=me 1787238 4 ews-feeder 2021-08-25 11:48:38 -0700 Committed r281571 (240935@main): <https://commits.webkit.org/240935@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 436390. 1787239 5 webkit-bug-importer 2021-08-25 11:49:27 -0700 <rdar://problem/82350525> 436384 2021-08-25 05:07:23 -0700 2021-08-25 08:10:22 -0700 v1 0001-JSC-Infinite-loop-in-for.in-after-r280760.patch text/plain 2275 xan.lopez RnJvbSBiYWYxNzFkYzczOTEzMDI0YzI0MmJkYzY1YjY5YmU1ZGM0NjBkNTdiIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/WGFuPTIwTD1DMz1CM3Blej89IDx4YW5AaWdh bGlhLmNvbT4KRGF0ZTogV2VkLCAyNSBBdWcgMjAyMSAxNDowNzowMyArMDIwMApTdWJqZWN0OiBb UEFUQ0hdIFtKU0NdIEluZmluaXRlIGxvb3AgaW4gZm9yLi4uaW4gYWZ0ZXIgcjI4MDc2MAogaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyOTQ5MwoKUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCgpBIG1pc3NpbmcgaW5zdHJ1Y3Rpb24gaW4gdGhlIDMyYml0IGJyYW5j aCBjYW4gcG90ZW50aWFsbHkgY2F1c2UKaW5maW5pdGUgbG9vcHMgd2hlbiB1c2luZyBmb3ItaW4u IE5vIG5ldyB0ZXN0LCB0aGlzIGlzIGFscmVhZHkKY292ZXJlZCBieSAoYW1vbmcgb3RoZXJzKSBM YXlvdXRUZXN0cy9qcy9yZXNlcnZlZC13b3Jkcy5odG1sLgoKKiBkZmcvREZHU3BlY3VsYXRpdmVK SVQuY3BwOgooSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlRW51bWVyYXRvck5leHRV cGRhdGVJbmRleEFuZE1vZGUpOgotLS0KIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cg ICAgICAgICAgICAgICAgIHwgMTQgKysrKysrKysrKysrKysKIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwIHwgIDEgKwogMiBmaWxlcyBjaGFuZ2VkLCAxNSBp bnNlcnRpb25zKCspCgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxv ZyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKaW5kZXggZmZhZGYwYTA0Nzk5Li42 OTJkY2RiNGUxNzAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cK KysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisy MDIxLTA4LTI1ICBYYW4gTG9wZXogIDx4YW5AaWdhbGlhLmNvbT4KKworICAgICAgICBbSlNDXSBJ bmZpbml0ZSBsb29wIGluIGZvci4uLmluIGFmdGVyIHIyODA3NjAKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyOTQ5MworCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEEgbWlzc2luZyBpbnN0cnVjdGlvbiBpbiB0 aGUgMzJiaXQgYnJhbmNoIGNhbiBwb3RlbnRpYWxseSBjYXVzZQorICAgICAgICBpbmZpbml0ZSBs b29wcyB3aGVuIHVzaW5nIGZvci1pbi4gTm8gbmV3IHRlc3QsIHRoaXMgaXMgYWxyZWFkeQorICAg ICAgICBjb3ZlcmVkIGJ5IChhbW9uZyBvdGhlcnMpIExheW91dFRlc3RzL2pzL3Jlc2VydmVkLXdv cmRzLmh0bWwuCisKKyAgICAgICAgKiBkZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwOgorICAgICAg ICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlRW51bWVyYXRvck5leHRVcGRhdGVJ bmRleEFuZE1vZGUpOgorCiAyMDIxLTA4LTI0ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KIAogICAgICAgICBSZWZhY3RvciBFTkFCTEUoSklUX09QRVJBVElPTl9WQUxJREFUSU9OKSBj b2RlIHRvIGVtaXQgbm8gY29kZSB3aGVuIGRpc2FibGVkLgpkaWZmIC0tZ2l0IGEvU291cmNlL0ph dmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcAppbmRleCAzOTQwYTRlOWFmZDMuLjExM2E3 ZDllMTkxZSAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxh dGl2ZUpJVC5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2 ZUpJVC5jcHAKQEAgLTEzNDQwLDYgKzEzNDQwLDcgQEAgdm9pZCBTcGVjdWxhdGl2ZUpJVDo6Y29t cGlsZUVudW1lcmF0b3JOZXh0VXBkYXRlSW5kZXhBbmRNb2RlKE5vZGUqIG5vZGUpCiAgICAgICAg IG1faml0Lm9yNjQoc2NyYXRjaC5ncHIoKSwgcmVzdWx0UmVncy5wYXlsb2FkR1BSKCkpOwogI2Vs c2UKICAgICAgICAgbV9qaXQubW92ZShUcnVzdGVkSW1tMzIoSlNQcm9wZXJ0eU5hbWVFbnVtZXJh dG9yOjpJbmRleGVkTW9kZSksIHJlc3VsdFJlZ3MudGFnR1BSKCkpOworICAgICAgICBtX2ppdC5v cjMyKHNjcmF0Y2guZ3ByKCksIHJlc3VsdFJlZ3MucGF5bG9hZEdQUigpKTsKICNlbmRpZgogCiAg ICAgICAgIGpzVmFsdWVSZXN1bHQocmVzdWx0UmVncywgbm9kZSk7Ci0tIAoyLjMxLjEKCg== 436390 2021-08-25 08:10:22 -0700 2021-08-25 11:48:39 -0700 v2 0001-JSC-Infinite-loop-in-for.in-after-r280760.patch text/plain 2275 xan.lopez RnJvbSBkYjdmMTcxMjgyNTE0YzM0ZDIzN2Q0MjcxYTJlNzcxOTc5ZDI0ZWIxIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/WGFuPTIwTD1DMz1CM3Blej89IDx4YW5AaWdh bGlhLmNvbT4KRGF0ZTogV2VkLCAyNSBBdWcgMjAyMSAxNDowNzowMyArMDIwMApTdWJqZWN0OiBb UEFUQ0hdIFtKU0NdIEluZmluaXRlIGxvb3AgaW4gZm9yLi4uaW4gYWZ0ZXIgcjI4MDc2MAogaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyOTQ5MwoKUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCgpBIG1pc3NpbmcgaW5zdHJ1Y3Rpb24gaW4gdGhlIDMyYml0IGJyYW5j aCBjYW4gcG90ZW50aWFsbHkgY2F1c2UKaW5maW5pdGUgbG9vcHMgd2hlbiB1c2luZyBmb3ItaW4u IE5vIG5ldyB0ZXN0LCB0aGlzIGlzIGFscmVhZHkKY292ZXJlZCBieSAoYW1vbmcgb3RoZXJzKSBM YXlvdXRUZXN0cy9qcy9yZXNlcnZlZC13b3Jkcy5odG1sLgoKKiBkZmcvREZHU3BlY3VsYXRpdmVK SVQuY3BwOgooSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlRW51bWVyYXRvck5leHRV cGRhdGVJbmRleEFuZE1vZGUpOgotLS0KIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cg ICAgICAgICAgICAgICAgIHwgMTQgKysrKysrKysrKysrKysKIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwIHwgIDEgKwogMiBmaWxlcyBjaGFuZ2VkLCAxNSBp bnNlcnRpb25zKCspCgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxv ZyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKaW5kZXggZmZhZGYwYTA0Nzk5Li42 OTJkY2RiNGUxNzAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cK KysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisy MDIxLTA4LTI1ICBYYW4gTG9wZXogIDx4YW5AaWdhbGlhLmNvbT4KKworICAgICAgICBbSlNDXSBJ bmZpbml0ZSBsb29wIGluIGZvci4uLmluIGFmdGVyIHIyODA3NjAKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyOTQ5MworCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEEgbWlzc2luZyBpbnN0cnVjdGlvbiBpbiB0 aGUgMzJiaXQgYnJhbmNoIGNhbiBwb3RlbnRpYWxseSBjYXVzZQorICAgICAgICBpbmZpbml0ZSBs b29wcyB3aGVuIHVzaW5nIGZvci1pbi4gTm8gbmV3IHRlc3QsIHRoaXMgaXMgYWxyZWFkeQorICAg ICAgICBjb3ZlcmVkIGJ5IChhbW9uZyBvdGhlcnMpIExheW91dFRlc3RzL2pzL3Jlc2VydmVkLXdv cmRzLmh0bWwuCisKKyAgICAgICAgKiBkZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwOgorICAgICAg ICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlRW51bWVyYXRvck5leHRVcGRhdGVJ bmRleEFuZE1vZGUpOgorCiAyMDIxLTA4LTI0ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KIAogICAgICAgICBSZWZhY3RvciBFTkFCTEUoSklUX09QRVJBVElPTl9WQUxJREFUSU9OKSBj b2RlIHRvIGVtaXQgbm8gY29kZSB3aGVuIGRpc2FibGVkLgpkaWZmIC0tZ2l0IGEvU291cmNlL0ph dmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcAppbmRleCAzOTQwYTRlOWFmZDMuLjJiNjM2 NjYxNjFiMSAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxh dGl2ZUpJVC5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2 ZUpJVC5jcHAKQEAgLTEzNDQwLDYgKzEzNDQwLDcgQEAgdm9pZCBTcGVjdWxhdGl2ZUpJVDo6Y29t cGlsZUVudW1lcmF0b3JOZXh0VXBkYXRlSW5kZXhBbmRNb2RlKE5vZGUqIG5vZGUpCiAgICAgICAg IG1faml0Lm9yNjQoc2NyYXRjaC5ncHIoKSwgcmVzdWx0UmVncy5wYXlsb2FkR1BSKCkpOwogI2Vs c2UKICAgICAgICAgbV9qaXQubW92ZShUcnVzdGVkSW1tMzIoSlNQcm9wZXJ0eU5hbWVFbnVtZXJh dG9yOjpJbmRleGVkTW9kZSksIHJlc3VsdFJlZ3MudGFnR1BSKCkpOworICAgICAgICBtX2ppdC5t b3ZlKHNjcmF0Y2guZ3ByKCksIHJlc3VsdFJlZ3MucGF5bG9hZEdQUigpKTsKICNlbmRpZgogCiAg ICAgICAgIGpzVmFsdWVSZXN1bHQocmVzdWx0UmVncywgbm9kZSk7Ci0tIAoyLjMxLjEKCg==