Bug 186818 – DirectArguments::create needs to initialize to undefined instead of the empty value

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

We have code in OSR exit that sets up length, but not capacity. This means get_from_arguments may end up loading an empty value, instead of undefined. We rely on it DirectArguments having at least up to the number of declared parameters slots being undefined if there are no arguments to the actual function

[Saam Barati]

The test case
```
function foo(a, b) {
    let x = arguments;
    OSRExit();
    return a + b; // Will load JSValue() instead of jsUndefined() since we'll materialize a DirectArguments in OSRExit that only has slots filled with JSValue()
}

function bar() {
    foo();
}
noInline(bar);

for (let i = 0; i < 1000; ++i) {
    bar();
}
```

[Saam Barati]

<rdar://problem/38415177>

[Saam Barati]

Created attachment 343118 [details]
patch

[WebKit Commit Bot]

Comment on attachment 343118 [details]
patch

Clearing flags on attachment: 343118

Committed r233000: <https://trac.webkit.org/changeset/233000>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.