Bug 228919 – New single bytecode loop for-in is missing many inline asm optimizations in 32bit

• Component: JavaScriptCore
• Status: NEW

[Keith Miller]

With the new bytecode format 32-bit is missing a bunch of inline assembly optimizations. Most of the code should be similar to the 64 bit code or the previous per-loop instructions.

[Radar WebKit Bug Importer]

<rdar://problem/81991479>

[Mikhail R. Gadelha]

Created attachment 435770 [details]
for-in-infinite-loop.js

[Mikhail R. Gadelha]

Created attachment 435771 [details]
for-in-undefined.js

[Mikhail R. Gadelha]

Comment on attachment 435770 [details]
for-in-infinite-loop.js

function makeobj(n) {
  var obj = {};
  for (var i = 0; i < n; ++i)
    obj[i] = i;
  return obj;
}

function testdelete(n) {
  for (var propToDelete = 0; propToDelete <= n; ++propToDelete) {
    for (var iterToDelete = 0; iterToDelete <= n; ++iterToDelete) {
      for (var iterToAdd = 0; iterToAdd <= n; ++iterToAdd) {

        print("testing with " + n + " properties");
        print("deleting property number " + propToDelete + " on iteration " +
              iterToDelete);
        print("adding a property on iteration " + iterToAdd);

        var iter = 0;
        var o = makeobj(n);

        for (var i in o) {
          if (iter == iterToDelete)
            delete o[propToDelete];

          if (iter == iterToAdd)
            o["xxx"] = 1;

          // print("iter: " + iter + "i: " + i);
          print(i)

          ++ iter;
        }
      }
    }
  }
}

testdelete(6);

[Mikhail R. Gadelha]

Added a couple of reduced test cases where jsc starts to return unexpected results:

* for-in-infinite-loop.js: for-in seems to be stuck and doesn't increment the value

* for-in-undefined.js: for-in returns undefined object at iteration 94