Bug 229951 – IntrinsicGetterAccessCase implementation of __proto__ needs to handle get_by_id_with_this

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Lukas Bernhard]

During differential testing of webkit I found a sample triggering a miscomputation related to super.__proto__ field. Depending on optimization level the value unexpectedly becomes "null".

The sample is invoked as:
WebKitBuild/Release/bin/jsc --validateOptions=true --useConcurrentJIT=false --useConcurrentGC=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --useFTLJIT=true sample.js

Changing --useFTLJIT=true to false changes the output.

function main() {
    let v41;

    v37 = class V37 {
        constructor() {
            v41 = super.__proto__;
        }
    };

    for (let v70 = 0; v70 < 100; v70++) {
        // decreasing the loop count to other values, e.g. 20 changes the behavior
        new v37();
    }

    print(v41); // outputs [object Object] or null, depending on --useFTLJIT=true/false
}
noDFG(main);
noFTL(main);
main();

[Radar WebKit Bug Importer]

<rdar://problem/82787527>

[Saam Barati]

Our IntrinsicGetter IC is using the wrong structure

[Saam Barati]

(In reply to Saam Barati from comment #2)
> Our IntrinsicGetter IC is using the wrong structure

This is wrong. It's using the wrong |this| for the "getter" access.

[Saam Barati]

Created attachment 439938 [details]
patch

[Saam Barati]

Created attachment 439956 [details]
patch

[Yusuke Suzuki]

Comment on attachment 439956 [details]
patch

r=me

[EWS]

Committed r283512 (242480@main): <https://commits.webkit.org/242480@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 439956 [details].