Summary: | ValueRep(DoubleRep(@v)) can not simply convert to @v | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Saam Barati <saam> | ||||||
Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | benjamin, commit-queue, fpizlo, ggaren, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, ticaiolima, webkit-bug-importer, ysuzuki | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Attachments: |
|
Description
Saam Barati
2017-06-21 19:19:23 PDT
This program crashes JSC: ``` let a1 = [1,2,3,4]; delete a1[2]; let a2 = []; a2.length = null; let thingy = {length: 2**55, __proto__: []}; let arrays = [ [10, {}, 20.5, 7821], a2, [10.2, 122.55, 10.22, 12.44], a2, [10,,10,,,20,,,,,50], a1, a2, ]; noInline(Array.prototype.map); let funcs = [ (x) => x, (x) => x, (x) => x, (x) => x, (x) => x, (x) => x, (x) => x, (x) => x, (x) => x, ]; function loop(x) { for (let i = 0; i < x; ++i) { try { if (i > 0 && (i % 1000) === 0) thingy.map(x => x) arrays[i % arrays.length].map(funcs[i % funcs.length]); } catch(e) { } } } loop(100000); ``` Created attachment 313650 [details]
patch
Comment on attachment 313650 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=313650&action=review r=me > Source/JavaScriptCore/ChangeLog:41 > + and weâll crash. This patch removes this strength reduction rule since it Please remove the non-ascii char in "we'll". Created attachment 313651 [details]
patch for landing
Comment on attachment 313651 [details] patch for landing View in context: https://bugs.webkit.org/attachment.cgi?id=313651&action=review > Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:221 > // This short-circuits circuitous conversions, like ValueRep(DoubleRep(value)) or > // even more complicated things. Like, it can handle a beast like > // ValueRep(DoubleRep(Int52Rep(value))). Seems like you should update this comment. It seems quite wrong... landed in: https://trac.webkit.org/changeset/218728/webkit and fixed the comment. |