64254 2011-07-11 01:37:36 -0700 DFG Speculative JIT does not always insert speculation checks when speculating arrays 2011-07-11 11:39:33 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 fpizlo webkit-unassigned webkit.review.bot oldest_to_newest 434706 0 fpizlo 2011-07-11 01:37:36 -0700 The DFG Speculative JIT attempts to guess the type of variables. Sometimes, it guesses that a variable is an array. The JIT should insert checking code that validates that variables that are speculate-array are actually arrays. However, the JIT does not insert these checks at PutLocal instructions, even though subsequent code assumes that specualte-array variables that are retrieved via GetLocal are already validated. 434708 1 100254 fpizlo 2011-07-11 01:49:16 -0700 Created attachment 100254 the patch 434970 2 ap 2011-07-11 10:21:24 -0700 Is there a reason why this doesn't have a regression test? 435047 3 100254 webkit.review.bot 2011-07-11 11:39:29 -0700 Comment on attachment 100254 the patch Clearing flags on attachment: 100254 Committed r90768: <http://trac.webkit.org/changeset/90768> 435049 4 webkit.review.bot 2011-07-11 11:39:33 -0700 All reviewed patches have been landed. Closing bug. 100254 2011-07-11 01:49:16 -0700 2011-07-11 11:39:29 -0700 the patch specarray_patch_1.diff text/plain 1944 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTA3MjcpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjAgQEAK KzIwMTEtMDctMTEgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBE RkcgU3BlY3VsYXRpdmUgSklUIGRvZXMgbm90IGFsd2F5cyBpbnNlcnQgc3BlY3VsYXRpb24gY2hl Y2tzIHdoZW4gc3BlY3VsYXRpbmcKKyAgICAgICAgYXJyYXlzLgorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NjQyNTQKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAgICAgIENoYW5nZWQgdGhlIFNldExvY2Fs IGluc3RydWN0aW9uIHRvIGFsd2F5cyB2YWxpZGF0ZSB0aGF0IHRoZSB2YWx1ZSBiZWluZyBzdG9y ZWQKKyAgICAgICAgaW50byB0aGUgbG9jYWwgdmFyaWFibGUgaXMgYW4gYXJyYXksIGlmIHRoYXQg dmFyaWFibGUgd2FzIG1hcmtlZCBQcmVkaWN0QXJyYXkuCisgICAgICAgIFRoaXMgaXMgbmVjZXNz YXJ5IHNpbmNlIHVzZXMgb2YgYXJyYXlzIGFzc3VtZSB0aGF0IGlmIGEgUHJlZGljdEFycmF5IHZh bHVlIGlzCisgICAgICAgIGluIGEgbG9jYWwgdmFyaWFibGUgdGhlbiB0aGUgc3BlY3VsYXRpb24g Y2hlY2sgdmFsaWRhdGluZyB0aGF0IHRoZSB2YWx1ZSBpcyBhbgorICAgICAgICBhcnJheSB3YXMg YWxyZWFkeSBwZXJmb3JtZWQuCisKKyAgICAgICAgKiBkZmcvREZHU3BlY3VsYXRpdmVKSVQuY3Bw OgorICAgICAgICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlKToKKwogMjAxMS0w Ny0wOSAgVGhvdXJheWEgQW5kb2xzaSAgPHRob3VyYXlhLmFuZG9sc2lAc3QuY29tPgogCiAgICAg ICAgIEZpeCB1bmFsaWduZWQgdXNlcnNwYWNlIGFjY2VzcyBmb3IgU0g0IHBsYXRmb3Jtcy4gCklu ZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklULmNw cAkocmV2aXNpb24gOTA3MjcpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1 bGF0aXZlSklULmNwcAkod29ya2luZyBjb3B5KQpAQCAtNDkxLDcgKzQ5MSw5IEBAIHZvaWQgU3Bl Y3VsYXRpdmVKSVQ6OmNvbXBpbGUoTm9kZSYgbm9kZSkKICAgICAgICAgfQogICAgICAgICBjYXNl IFByZWRpY3RBcnJheTogewogICAgICAgICAgICAgU3BlY3VsYXRlQ2VsbE9wZXJhbmQgY2VsbCh0 aGlzLCBub2RlLmNoaWxkMSgpKTsKLSAgICAgICAgICAgIG1faml0LnN0b3JlUHRyKGNlbGwuZ3By KCksIEpJVENvbXBpbGVyOjphZGRyZXNzRm9yKG5vZGUubG9jYWwoKSkpOworICAgICAgICAgICAg R1BSUmVnIGNlbGxHUFIgPSBjZWxsLmdwcigpOworICAgICAgICAgICAgc3BlY3VsYXRpb25DaGVj ayhtX2ppdC5icmFuY2hQdHIoTWFjcm9Bc3NlbWJsZXI6Ok5vdEVxdWFsLCBNYWNyb0Fzc2VtYmxl cjo6QWRkcmVzcyhjZWxsR1BSKSwgTWFjcm9Bc3NlbWJsZXI6OlRydXN0ZWRJbW1QdHIobV9qaXQu Z2xvYmFsRGF0YSgpLT5qc0FycmF5VlB0cikpKTsKKyAgICAgICAgICAgIG1faml0LnN0b3JlUHRy KGNlbGxHUFIsIEpJVENvbXBpbGVyOjphZGRyZXNzRm9yKG5vZGUubG9jYWwoKSkpOwogICAgICAg ICAgICAgbm9SZXN1bHQobV9jb21waWxlSW5kZXgpOwogICAgICAgICAgICAgYnJlYWs7CiAgICAg ICAgIH0K