Bug 193513

Summary: [JSC] ToThis omission in DFGByteCodeParser is wrong
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, ews-watchlist, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Performance Numbers
none
Patch none

Description Yusuke Suzuki 2019-01-16 15:38:25 PST
It assumes that `ToThis(ToThis(value)) === ToThis(value)`. But it is wrong since the semantics of ToThis in strict mode and ToThis in sloppy mode is different.
If `ToThisFromSloppyMode(ToThisFromStrictMode(value))` is converted to `ToThisFromStrictMode(value)`, we have a bad time!
Comment 1 Yusuke Suzuki 2019-01-16 16:13:09 PST
This is not necessary. Original intent is already implemented in AI.
Comment 2 Yusuke Suzuki 2019-01-16 16:55:53 PST
Upload a patch after I ensured that the result is perf-neutral.
Comment 3 Yusuke Suzuki 2019-01-16 19:58:49 PST
Created attachment 359344 [details]
Patch

WIP
Comment 4 Yusuke Suzuki 2019-01-16 20:07:38 PST
<rdar://problem/45842236>
Comment 5 Yusuke Suzuki 2019-01-16 21:07:44 PST
Created attachment 359348 [details]
Performance Numbers

Performance looks neutral.
Comment 6 Yusuke Suzuki 2019-01-16 21:11:51 PST
Created attachment 359349 [details]
Patch
Comment 7 WebKit Commit Bot 2019-01-17 00:10:59 PST
Comment on attachment 359349 [details]
Patch

Clearing flags on attachment: 359349

Committed r240106: <https://trac.webkit.org/changeset/240106>
Comment 8 WebKit Commit Bot 2019-01-17 00:11:01 PST
All reviewed patches have been landed.  Closing bug.