Bug 213310 – [JSC] Freeze JSBigInt when setting it as a constant in AI

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Yusuke Suzuki]

[JSC] Freeze JSBigInt when setting it as a constant in AI

[Yusuke Suzuki]

Created attachment 402137 [details]
Patch

[Yusuke Suzuki]

<rdar://problem/64450410>

[Mark Lam]

Comment on attachment 402137 [details]
Patch

r=me

[Saam Barati]

Comment on attachment 402137 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=402137&action=review

> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:2707
> +                setConstant(node, *m_graph.freeze(childConst.asCell()));

is there anywhere else in AI/constant folding we're missing this?

Should setConstant assert?

[Saam Barati]

r=me too

[Yusuke Suzuki]

Comment on attachment 402137 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=402137&action=review

>> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:2707
>> +                setConstant(node, *m_graph.freeze(childConst.asCell()));
> 
> is there anywhere else in AI/constant folding we're missing this?
> 
> Should setConstant assert?

setConstant (specifically, setConstant's FrozenValue constructor) has assertion, and this assertion fired with the attached test.
I've checked AI code and this is the only place about BigInt thing.

[Yusuke Suzuki]

Windows failure is fast/dom/Window/alert-with-unmatched-utf16-surrogate-should-not-crash.html, which is unrelated to this one.

[EWS]

Committed r263180: <https://trac.webkit.org/changeset/263180>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 402137 [details].