Bug 119830 – Assigning to a readonly global results in DFG byte code parse failure

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Oliver Hunt]

JSC fails to compile

for (;;) { try { eval("NaN = 0"); } catch(e) {} }

Due to a parse failure of Dynamic put

[Oliver Hunt]

Created attachment 208838 [details]
Patch

[Filip Pizlo]

Comment on attachment 208838 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review

> Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178
> +        // If we're writing to a readonly property we emit a Dynamic put that
> +        // the DFG can't currently handle.

Really?

[Filip Pizlo]

Comment on attachment 208838 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review

>> Source/JavaScriptCore/dfg/DFGCapabilities.cpp:178
>> +        // the DFG can't currently handle.
> 
> Really?

Oh, yeah, really.

[Oliver Hunt]

Committed r154120: <http://trac.webkit.org/changeset/154120>

[Filip Pizlo]

Comment on attachment 208838 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208838&action=review

> Source/JavaScriptCore/dfg/DFGCapabilities.cpp:186
> -        ResolveType resolveType = static_cast<ResolveType>(pc[3].u.operand);
> +        ResolveType resolveType = ResolveModeAndType(pc[4].u.operand).type();

Why?  It appears that the DFG bytecodeparser and the bytecompiler both put the type in 3, not 4.