Bug 138476 – slow_path_get_direct_pname() needs to be hardened against a constant baseValue

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

CommonSlowPath's slow_path_get_direct_pname() currently assumes that the baseValue is always a non-constant register.  However, this is not always the case like in the following:

    function foo() {
        var o = { a:1 };
        for (var n in o)
            0[n];
    };
    foo();

<rdar://problem/18495847>

[Mark Lam]

Created attachment 241135 [details]
the patch.

[Michael Saboff]

Comment on attachment 241135 [details]
the patch.

The code change looks fine.  The test changes are change to the test beyond just adding cases for the fix.  Therefore please break out the test enhancements as a separate patch.

[Mark Lam]

Created attachment 241142 [details]
take 2: minus test refactoring

[Michael Saboff]

Comment on attachment 241142 [details]
take 2: minus test refactoring

r=me

[Mark Lam]

Thanks for the review.  Landed in r175724: <http://trac.webkit.org/r175724>.

[Simon Fraser (smfr)]

It looks like this broke 3 JSC tests:
https://build.webkit.org/builders/Apple%20Yosemite%2032-bit%20JSC%20%28BuildAndTest%29?numbuilds=100

[Mark Lam]

(In reply to comment #6)
> It looks like this broke 3 JSC tests:
> https://build.webkit.org/builders/Apple%20Yosemite%2032-
> bit%20JSC%20%28BuildAndTest%29?numbuilds=100

I’m looking into it.

[Mark Lam]

(In reply to comment #6)
> It looks like this broke 3 JSC tests:
> https://build.webkit.org/builders/Apple%20Yosemite%2032-
> bit%20JSC%20%28BuildAndTest%29?numbuilds=100

The issue is due to a latent bug that is uncovered by the new tests.  I'll skip the tests (from the JSC test set) temporarily while I debug the issue.  This work is tracked in https://bugs.webkit.org/show_bug.cgi?id=138497.