Bug 209363 - hasObservableSideEffectsForRegExpSplit doesn't check for @@match override
Summary: hasObservableSideEffectsForRegExpSplit doesn't check for @@match override
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Ross Kirsling
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-03-20 15:09 PDT by Ross Kirsling
Modified: 2020-03-24 17:15 PDT (History)
9 users (show)

See Also:


Attachments
Patch (6.39 KB, patch)
2020-03-20 15:15 PDT, Ross Kirsling
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ross Kirsling 2020-03-20 15:09:01 PDT
hasObservableSideEffectsForRegExpSplit doesn't check for @@match override
Comment 1 Ross Kirsling 2020-03-20 15:15:59 PDT
Created attachment 394136 [details]
Patch
Comment 2 Radar WebKit Bug Importer 2020-03-20 15:31:52 PDT
<rdar://problem/60707365>
Comment 3 Michael Saboff 2020-03-20 15:57:11 PDT
Comment on attachment 394136 [details]
Patch

r=me. Looks good.
Comment 4 Ross Kirsling 2020-03-20 16:06:04 PDT
(In reply to Michael Saboff from comment #3)
> Comment on attachment 394136 [details]
> Patch
> 
> r=me. Looks good.

Thanks, Michael!
Comment 5 EWS 2020-03-20 17:38:52 PDT
Committed r258801: <https://trac.webkit.org/changeset/258801>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 394136 [details].
Comment 6 Yusuke Suzuki 2020-03-22 18:08:52 PDT
Comment on attachment 394136 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=394136&action=review

> Source/JavaScriptCore/builtins/RegExpPrototype.js:467
> +    if (regexp.@@match !== @regExpPrototypeSymbolMatch)
> +        return true;

Why don't we use @tryGetById for this access?
Comment 7 Ross Kirsling 2020-03-22 19:01:03 PDT
(In reply to Yusuke Suzuki from comment #6)
> Comment on attachment 394136 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=394136&action=review
> 
> > Source/JavaScriptCore/builtins/RegExpPrototype.js:467
> > +    if (regexp.@@match !== @regExpPrototypeSymbolMatch)
> > +        return true;
> 
> Why don't we use @tryGetById for this access?

I was just mimicking this:
https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/builtins/StringPrototype.js#L222
https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/builtins/StringPrototype.js#L249

I didn't realize @tryGetById worked with symbols, but I can make an update if you prefer.
Comment 8 Yusuke Suzuki 2020-03-22 19:10:04 PDT
(In reply to Ross Kirsling from comment #7)
> (In reply to Yusuke Suzuki from comment #6)
> > Comment on attachment 394136 [details]
> > Patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=394136&action=review
> > 
> > > Source/JavaScriptCore/builtins/RegExpPrototype.js:467
> > > +    if (regexp.@@match !== @regExpPrototypeSymbolMatch)
> > > +        return true;
> > 
> > Why don't we use @tryGetById for this access?
> 
> I was just mimicking this:
> https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/builtins/
> StringPrototype.js#L222
> https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/builtins/
> StringPrototype.js#L249
> 
> I didn't realize @tryGetById worked with symbols, but I can make an update
> if you prefer.

While @tryGetById is not observable to users, usual get can be observable by setting a getter here.
So if this check is not observable to users, we need to use @tryGetById.

For example, String#replace is accessing @@replace explicitly in an observable way in https://tc39.es/ecma262/#sec-string.prototype.replace. So, xxx.@@replace is fine.

On the other hand, I think hasObservableSideEffectsForRegExpSplit should not be observable to users.
So we need to use @tryGetById.
Comment 9 Ross Kirsling 2020-03-22 19:15:45 PDT
(In reply to Yusuke Suzuki from comment #8)
> While @tryGetById is not observable to users, usual get can be observable by
> setting a getter here.
> So if this check is not observable to users, we need to use @tryGetById.
> 
> For example, String#replace is accessing @@replace explicitly in an
> observable way in https://tc39.es/ecma262/#sec-string.prototype.replace. So,
> xxx.@@replace is fine.
> 
> On the other hand, I think hasObservableSideEffectsForRegExpSplit should not
> be observable to users.
> So we need to use @tryGetById.

Oh! You're quite right, thanks for that explanation. Will fix.
Comment 10 Ross Kirsling 2020-03-23 12:05:38 PDT
(In reply to Ross Kirsling from comment #9)
> Oh! You're quite right, thanks for that explanation. Will fix.

Committed r258865: <https://trac.webkit.org/changeset/258865>
Comment 11 Saam Barati 2020-03-24 15:45:37 PDT
(In reply to Ross Kirsling from comment #10)
> (In reply to Ross Kirsling from comment #9)
> > Oh! You're quite right, thanks for that explanation. Will fix.
> 
> Committed r258865: <https://trac.webkit.org/changeset/258865>

In your fix, it feels like the else in your ternary should assert it's looking at a symbol.
Comment 12 Yusuke Suzuki 2020-03-24 16:12:38 PDT
(In reply to Saam Barati from comment #11)
> (In reply to Ross Kirsling from comment #10)
> > (In reply to Ross Kirsling from comment #9)
> > > Oh! You're quite right, thanks for that explanation. Will fix.
> > 
> > Committed r258865: <https://trac.webkit.org/changeset/258865>
> 
> In your fix, it feels like the else in your ternary should assert it's
> looking at a symbol.

Yeah, I think this is not good. Super easiest way to fix this problem is having @tryGetByIdWellKnownSymbol(..., "match"), and emit try_get_by_id with well-known symbol.
Comment 13 Ross Kirsling 2020-03-24 16:15:43 PDT
(In reply to Yusuke Suzuki from comment #12)
> (In reply to Saam Barati from comment #11)
> > (In reply to Ross Kirsling from comment #10)
> > > (In reply to Ross Kirsling from comment #9)
> > > > Oh! You're quite right, thanks for that explanation. Will fix.
> > > 
> > > Committed r258865: <https://trac.webkit.org/changeset/258865>
> > 
> > In your fix, it feels like the else in your ternary should assert it's
> > looking at a symbol.
> 
> Yeah, I think this is not good. Super easiest way to fix this problem is
> having @tryGetByIdWellKnownSymbol(..., "match"), and emit try_get_by_id with
> well-known symbol.

Is this better than asserting identifier().isPrivateName() for the ResolveNode case?
Comment 14 Yusuke Suzuki 2020-03-24 16:45:17 PDT
Discussed with Ross in slack, we will open a bug to fix the above issue.
Comment 15 Ross Kirsling 2020-03-24 17:15:09 PDT
(In reply to Yusuke Suzuki from comment #14)
> Discussed with Ross in slack, we will open a bug to fix the above issue.

Opened bug 209524.