231322 2021-10-06 12:48:14 -0700 ArrayBuffer species watchpoint being invalidated doesn't mean it's not an ArrayBuffer constructor from the same global object 2021-11-01 13:10:36 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build PC Linux RESOLVED FIXED InRadar P2 Normal --- 1 lukas.bernhard saam ews-watchlist keith_miller mark.lam msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1801269 0 lukas.bernhard 2021-10-06 12:48:14 -0700 Differential testing identifies the following samples to trigger a miscomputation in JSC. Tested on e467a9710432ebb3dae9880f897cf93929adc0e6 (Wed Oct 6 16:30:57 2021 +0000) Release/bin/jsc --validateOptions=true --useConcurrentJIT=false --useConcurrentGC=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --useFTLJIT=true diff.js function main() { async function v23(v24) { for (let v30 = 0; v30 < 60000; v30++) { } ArrayBuffer.prototype.constructor = ArrayBuffer; } const v22 = [0, 0, 0]; const v35 = v22.filter(v23); const v37 = [0, 0, 0] const v42 = new Uint8ClampedArray(v37); const v43 = new Uint32Array(v42); // without FTL: RangeError: Length out of range of buffer print(v43.length); // prints 3 with FTL (also 3 in v8). with --useFTLJIT=true this statement is not executed due to the previous exception } main(); 1803918 1 webkit-bug-importer 2021-10-13 12:49:12 -0700 <rdar://problem/84212078> 1810359 2 442892 saam 2021-10-29 18:41:16 -0700 Created attachment 442892 patch 1810360 3 442892 ysuzuki 2021-10-29 18:42:44 -0700 Comment on attachment 442892 patch r=me 1810832 4 ews-feeder 2021-11-01 13:10:33 -0700 Committed r285123 (243764@main): <https://commits.webkit.org/243764@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 442892. 442892 2021-10-29 18:41:16 -0700 2021-11-01 13:10:34 -0700 patch a-backup.diff text/plain 4149 saam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyODUwNjgpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE1IEBACisyMDIxLTEwLTI5ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu Y29tPgorCisgICAgICAgIEFycmF5QnVmZmVyIHNwZWNpZXMgd2F0Y2hwb2ludCBiZWluZyBpbnZh bGlkYXRlZCBkb2Vzbid0IG1lYW4gaXQncyBub3QgYW4gQXJyYXlCdWZmZXIgY29uc3RydWN0b3Ig ZnJvbSB0aGUgc2FtZSBnbG9iYWwgb2JqZWN0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0yMzEzMjIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzg0MjEy MDc4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICog c3RyZXNzL2FycmF5LWJ1ZmZlci1zcGVjaWVzLXdhdGNocG9pbnQtc2hvdWxkLW5vdC1kaWN0YXRl LWlmLWNvbnN0cnVjdG9yLWlzLWNvcnJlY3QuanM6IEFkZGVkLgorICAgICAgICAobWFpbi5hc3lu YyB2MjMpOgorICAgICAgICAobWFpbik6CisKIDIwMjEtMTAtMjkgIERtaXRyeSBCZXpoZXRza292 ICA8ZGJlemhldHNrb3ZAaWdhbGlhLmNvbT4KIAogICAgICAgICBbV0FTTS1GdW5jdGlvbi1SZWZl cmVuY2VzXSBBZGQgc3VwcG9ydCBmb3IgKHJlZi5udWxsIGhlYXB0eXBlKQpJbmRleDogSlNUZXN0 cy9zdHJlc3MvYXJyYXktYnVmZmVyLXNwZWNpZXMtd2F0Y2hwb2ludC1zaG91bGQtbm90LWRpY3Rh dGUtaWYtY29uc3RydWN0b3ItaXMtY29ycmVjdC5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3RzL3N0 cmVzcy9hcnJheS1idWZmZXItc3BlY2llcy13YXRjaHBvaW50LXNob3VsZC1ub3QtZGljdGF0ZS1p Zi1jb25zdHJ1Y3Rvci1pcy1jb3JyZWN0LmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3Ry ZXNzL2FycmF5LWJ1ZmZlci1zcGVjaWVzLXdhdGNocG9pbnQtc2hvdWxkLW5vdC1kaWN0YXRlLWlm LWNvbnN0cnVjdG9yLWlzLWNvcnJlY3QuanMJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwxNiBA QAorLy9AIHJ1bkRlZmF1bHQoIi0tdXNlQ29uY3VycmVudEpJVD1mYWxzZSIsICItLXVzZUNvbmN1 cnJlbnRHQz1mYWxzZSIsICItLXRocmVzaG9sZEZvckpJVFNvb249MTAiLCAiLS10aHJlc2hvbGRG b3JKSVRBZnRlcldhcm1VcD0xMCIsICItLXRocmVzaG9sZEZvck9wdGltaXplQWZ0ZXJXYXJtVXA9 MTAwIiwgIi0tdGhyZXNob2xkRm9yT3B0aW1pemVBZnRlckxvbmdXYXJtVXA9MTAwIiwgIi0tdGhy ZXNob2xkRm9yT3B0aW1pemVTb29uPTEwMCIsICItLXRocmVzaG9sZEZvckZUTE9wdGltaXplQWZ0 ZXJXYXJtVXA9MTAwMCIsICItLXRocmVzaG9sZEZvckZUTE9wdGltaXplU29vbj0xMDAwIiwgIi0t dmFsaWRhdGVCQ0U9dHJ1ZSIsICItLXVzZUNvbmN1cnJlbnRKSVQ9MCIsICItLWR1bXBGVExEaXNh c3NlbWJseT0wIiwgIi0tdXNlRlRMSklUPTAiKQorCitmdW5jdGlvbiBtYWluKCkgeworICAgIGFz eW5jIGZ1bmN0aW9uIHYyMyh2MjQpIHsKKyAgICAgICAgZm9yIChsZXQgdjMwID0gMDsgdjMwIDwg NjAwMDA7IHYzMCsrKSB7IH0gCisgICAgICAgIEFycmF5QnVmZmVyLnByb3RvdHlwZS5jb25zdHJ1 Y3RvciA9IEFycmF5QnVmZmVyOworICAgIH0KKyAgICAKKyAgICBjb25zdCB2MjIgPSBbMCwgMCwg MF07IAorICAgIGNvbnN0IHYzNSA9IHYyMi5maWx0ZXIodjIzKTsKKyAgICAKKyAgICBjb25zdCB2 MzcgPSBbMCwgMCwgMF0KKyAgICBjb25zdCB2NDIgPSBuZXcgVWludDhDbGFtcGVkQXJyYXkodjM3 KTsKKyAgICBjb25zdCB2NDMgPSBuZXcgVWludDMyQXJyYXkodjQyKTsKK30KK21haW4oKTsKSW5k ZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjg1MDE4KQorKysgU291cmNlL0ph dmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisy MDIxLTEwLTI5ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAgIEFy cmF5QnVmZmVyIHNwZWNpZXMgd2F0Y2hwb2ludCBiZWluZyBpbnZhbGlkYXRlZCBkb2Vzbid0IG1l YW4gaXQncyBub3QgYW4gQXJyYXlCdWZmZXIgY29uc3RydWN0b3IgZnJvbSB0aGUgc2FtZSBnbG9i YWwgb2JqZWN0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0yMzEzMjIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzg0MjEyMDc4PgorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFdlIHdlcmUgcmVseWluZyBvbiB0 aGUgd2F0Y2hwb2ludCB0byB0ZWxsIHVzIGlmIHRoZSBBcnJheSBzcGVjaWVzIHdhdGNocG9pbnQK KyAgICAgICAgZm9yICdjb25zdHJ1Y3RvcicgaXMgc2V0IHRvIHRoZSByaWdodCB2YWx1ZS4gSG93 ZXZlciwgdGhlIHdhdGNocG9pbnQgYmVpbmcKKyAgICAgICAgZmlyZWQgZG9lc24ndCBndWFyYW50 ZWUgdGhhdCBpdCB3b24ndCBiZSB0aGUgcmlnaHQgdmFsdWUuIEZvciBleGFtcGxlLCB3ZQorICAg ICAgICBtaWdodCBub3QgYmUgYWJsZSB0byBpbnN0YWxsIHRoZSB3YXRjaHBvaW50IGJlY2F1c2Ug dGhlIHJlcGxhY2VtZW50IHdhdGNocG9pbnQKKyAgICAgICAgbWF5IGFscmVhZHkgYmUgZmlyZWQu CisKKyAgICAgICAgKiBydW50aW1lL0pTQXJyYXlCdWZmZXJQcm90b3R5cGUuY3BwOgorICAgICAg ICAoSlNDOjphcnJheUJ1ZmZlclNwZWNpZXNDb25zdHJ1Y3RvclNsb3cpOgorCiAyMDIxLTEwLTI4 ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgogCiAgICAgICAgIERvbid0IGNhbGwg dHlwZSgpIG9uIFN0cnVjdHVyZSwgaW5zdGVhZCBjYWxsIHR5cGUoKSBvbiBpdHMgdHlwZUluZm8o KQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNBcnJheUJ1ZmZlclByb3Rv dHlwZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNB cnJheUJ1ZmZlclByb3RvdHlwZS5jcHAJKHJldmlzaW9uIDI4NTAxOCkKKysrIFNvdXJjZS9KYXZh U2NyaXB0Q29yZS9ydW50aW1lL0pTQXJyYXlCdWZmZXJQcm90b3R5cGUuY3BwCSh3b3JraW5nIGNv cHkpCkBAIC01Miw5ICs1Miw4IEBAIHN0ZDo6b3B0aW9uYWw8SlNWYWx1ZT4gYXJyYXlCdWZmZXJT cGVjaWUKICAgICBpZiAoY29uc3RydWN0b3IuaXNDb25zdHJ1Y3Rvcih2bSkpIHsKICAgICAgICAg SlNPYmplY3QqIGNvbnN0cnVjdG9yT2JqZWN0ID0ganNDYXN0PEpTT2JqZWN0Kj4oY29uc3RydWN0 b3IpOwogICAgICAgICBKU0dsb2JhbE9iamVjdCogZ2xvYmFsT2JqZWN0RnJvbUNvbnN0cnVjdG9y ID0gY29uc3RydWN0b3JPYmplY3QtPmdsb2JhbE9iamVjdCh2bSk7Ci0gICAgICAgIGJvb2wgaXNB cnJheUJ1ZmZlckNvbnN0cnVjdG9yRnJvbUFub3RoZXJSZWFsbSA9IGdsb2JhbE9iamVjdCAhPSBn bG9iYWxPYmplY3RGcm9tQ29uc3RydWN0b3IKLSAgICAgICAgICAgICYmIGNvbnN0cnVjdG9yT2Jq ZWN0ID09IGdsb2JhbE9iamVjdEZyb21Db25zdHJ1Y3Rvci0+YXJyYXlCdWZmZXJDb25zdHJ1Y3Rv cihtb2RlKTsKLSAgICAgICAgaWYgKGlzQXJyYXlCdWZmZXJDb25zdHJ1Y3RvckZyb21Bbm90aGVy UmVhbG0pCisgICAgICAgIGJvb2wgaXNBbnlBcnJheUJ1ZmZlckNvbnN0cnVjdG9yID0gY29uc3Ry dWN0b3JPYmplY3QgPT0gZ2xvYmFsT2JqZWN0RnJvbUNvbnN0cnVjdG9yLT5hcnJheUJ1ZmZlckNv bnN0cnVjdG9yKG1vZGUpOworICAgICAgICBpZiAoaXNBbnlBcnJheUJ1ZmZlckNvbnN0cnVjdG9y KQogICAgICAgICAgICAgcmV0dXJuIHN0ZDo6bnVsbG9wdDsKICAgICB9CiAK