Bug 58600 – DFG JIT bugs in ValueToInt, PutByVal

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Gavin Barraclough]

The issues are demonstrated by the following code:

    function putSelf(array, index)
    {
        index = index << 0;
        array[index] = index;
        return true;
    }

    shouldBeTrue("putSelf([0], 0);");
    shouldBeTrue("putSelf([0], 1/9);");

The bug in PutByVal is that an operand is in JSValueOperand - when this locks an integer into a register it will always retag the value without checking if the register is already locked.  This is a problem where the value being stored by a PutByVal is the same as the subscript.  The subscript is locked into a register first, as a strict integer.  Locking the value results in the subscript being modified.

The bug in ValueToInt related to the function of sillentFillAllRegisters.  The problem is that this method will restore all register values from prior to the call, overwriting the result of the call out.  Allow a register to be passed to specifically be excluded from being preserved.

[Gavin Barraclough]

Created attachment 89684 [details]
The patch

[WebKit Review Bot]

Attachment 89684 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1

Source/JavaScriptCore/ChangeLog:1:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
LayoutTests/ChangeLog:1:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
Total errors found: 2 in 21 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Geoffrey Garen]

Comment on attachment 89684 [details]
The patch

r=me

[Gavin Barraclough]

fixed in r83916