Bug 142862 – ES6 Classes: Runtime error in JIT'd class calling super() with arguments and superclass has default constructor

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Joseph Pecoraro]

* SUMMARY
Runtime error in JIT'd class calling super() with arguments and superclass has default constructor. Doesn't happen if just called a few times.

* TEST
<script>
var A = class A { };
var B = class B extends A { };
var C = class C extends B { constructor() { super(); } };

(function() {
    var x;
    for (var i = 0; i < 1e5; ++i)
        x = new C(false); // NOTE: argument is important
    console.log(x);
})();
</script>

* ACTUAL
[Error] TypeError: undefined is not a constructor (evaluating 'super(...arguments)')

* EXPECTED
=> no exceptions.

* NOTES
- adding a "constructor() { super(); }" to class B this works.
- if the inspector is open this works, so the inspector likely prevents reaching a certain JIT tier

[Joseph Pecoraro]

Created attachment 249021 [details]
[TEST] Reduction

Insect the test page. If you see an error, something incorrect happened!

[Joseph Pecoraro]

(In reply to comment #1)
> Created attachment 249021 [details]
> [TEST] Reduction
> 
> Inspect the test page. If you see an error, something incorrect happened!

Of course this means to reproduce the error you have to close the inspector, reload the page, then open the inspector.

[Ryosuke Niwa]

(In reply to comment #2)
> (In reply to comment #1)
> > Created attachment 249021 [details]
> > [TEST] Reduction
> > 
> > Inspect the test page. If you see an error, something incorrect happened!
> 
> Of course this means to reproduce the error you have to close the inspector,
> reload the page, then open the inspector.

It looks like this is a bug in DFG. Disabling DFG JIT also fixes the bug.

[Ryosuke Niwa]

var A = class A { };
var B = class B extends A { super(...arguments) };
var C = class C extends B { constructor() { super(); } };

will also fail but forcing B to be not inlined will fix the bug so it looks like we're not inlining B in DFG correctly.

[Radar WebKit Bug Importer]

<rdar://problem/20231235>

[Ryosuke Niwa]

Looks like this has been fixed by Phil's mega patch for arguments.

[Ryosuke Niwa]

Created attachment 249639 [details]
Adds a test

[Ryosuke Niwa]

Created attachment 249641 [details]
Removed the workaround in Web Inspector

[Ryosuke Niwa]

Will land the patch one more test per Ben's in-person comment.

[Ryosuke Niwa]

Committed r182100: <http://trac.webkit.org/changeset/182100>