Skip to content

Commit a72d198

Browse files
ConstellationConstellation
committed
[JSC] FTL materialization is missing several internal object types
https://bugs.webkit.org/show_bug.cgi?id=299457 rdar://161147884 Reviewed by Keith Miller. FTL materialization is missing several internal object types. This patch adds them. Test: JSTests/stress/ftl-materialization-missing.js * JSTests/stress/ftl-materialization-missing.js: Added. (try.iso): (try.utc): * Source/JavaScriptCore/ftl/FTLOperations.cpp: (JSC::FTL::JSC_DEFINE_NOEXCEPT_JIT_OPERATION): Canonical link: https://commits.webkit.org/300485@main
1 parent d2e5b82 commit a72d198

2 files changed

Lines changed: 67 additions & 30 deletions

File tree

‎JSTests/stress/ftl-materialization-missing.js‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
//@ runDefault("--useConcurrentJIT=0", "--jitPolicyScale=0")
2+
try {
3+
var BUGNUMBER = 730831;
4+
var summary = "Date.prototype.toISOString returns an invalid ISO-8601 string";
5+
print((BUGNUMBER + ": ") + summary);
6+
function iso(a10) {
7+
const v12 = new Date(a10);
8+
return v12.toISOString();
9+
}
10+
for (let v14 = 0; v14 < 67; v14++) {
11+
const v16 = [print];
12+
Reflect.apply(summary.matchAll, summary, v16);
13+
}
14+
function utc(a20, a21, a22, a23, a24, a25, a26) {
15+
const v29 = new Date_1(0);
16+
var date = v29;
17+
date.setUTCFullYear(a20, a21 - 1, a22);
18+
date.setUTCHours(a23, a24, a25, a26);
19+
return date.getTime();
20+
}
21+
var maxDateSimple = utc(9999, 12, 31, 23, 59, 59, 999);
22+
var minDateSimple = utc(0, 1, 1, 0, 0, 0, 0);
23+
var maxDateExtended = utc(+275760, 9, 13, 0, 0, 0, 0);
24+
var minDateExtended = utc(-271821, 4, 20, 0, 0, 0, 0);
25+
} catch { }

‎Source/JavaScriptCore/ftl/FTLOperations.cpp‎

Lines changed: 42 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
#include "FrameTracers.h"
3838
#include "InlineCallFrame.h"
3939
#include "JSArrayIterator.h"
40+
#include "JSAsyncFromSyncIterator.h"
4041
#include "JSAsyncFunction.h"
4142
#include "JSAsyncGeneratorFunction.h"
4243
#include "JSCellButterfly.h"
@@ -46,7 +47,10 @@
4647
#include "JSIteratorHelper.h"
4748
#include "JSLexicalEnvironment.h"
4849
#include "JSMapIterator.h"
50+
#include "JSPromiseAllContext.h"
51+
#include "JSRegExpStringIterator.h"
4952
#include "JSSetIterator.h"
53+
#include "JSWrapForValidIterator.h"
5054
#include "RegExpObject.h"
5155
#include "ResourceExhaustion.h"
5256
#include "VMTrapsInlines.h"
@@ -177,6 +181,18 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationPopulateObjectInOSR, void, (JSGlobalO
177181
case JSIteratorHelperType:
178182
materialize(jsCast<JSIteratorHelper*>(target));
179183
break;
184+
case JSWrapForValidIteratorType:
185+
materialize(jsCast<JSWrapForValidIterator*>(target));
186+
break;
187+
case JSAsyncFromSyncIteratorType:
188+
materialize(jsCast<JSAsyncFromSyncIterator*>(target));
189+
break;
190+
case JSPromiseAllContextType:
191+
materialize(jsCast<JSPromiseAllContext*>(target));
192+
break;
193+
case JSRegExpStringIteratorType:
194+
materialize(jsCast<JSRegExpStringIterator*>(target));
195+
break;
180196
case JSPromiseType:
181197
if (target->classInfo() == JSInternalPromise::info())
182198
materialize(jsCast<JSInternalPromise*>(target));
@@ -451,38 +467,34 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationMaterializeObjectInOSR, HeapCell*, (J
451467
// The real values will be put subsequently by
452468
// operationPopulateNewObjectInOSR. See the PhantomNewObject
453469
// case for details.
454-
switch (structure->typeInfo().type()) {
455-
case JSArrayIteratorType: {
456-
JSArrayIterator* result = JSArrayIterator::createWithInitialValues(vm, structure);
457-
RELEASE_ASSERT(materialization->properties().size() - 1 == JSArrayIterator::numberOfInternalFields);
458-
return result;
459-
}
460-
case JSMapIteratorType: {
461-
JSMapIterator* result = JSMapIterator::createWithInitialValues(vm, structure);
462-
RELEASE_ASSERT(materialization->properties().size() - 1 == JSMapIterator::numberOfInternalFields);
463-
return result;
464-
}
465-
case JSSetIteratorType: {
466-
JSSetIterator* result = JSSetIterator::createWithInitialValues(vm, structure);
467-
RELEASE_ASSERT(materialization->properties().size() - 1 == JSSetIterator::numberOfInternalFields);
470+
auto create = [&]<typename T>() -> T* {
471+
auto* result = T::createWithInitialValues(vm, structure);
472+
RELEASE_ASSERT(materialization->properties().size() - 1 == T::numberOfInternalFields);
468473
return result;
469-
}
470-
case JSIteratorHelperType: {
471-
JSIteratorHelper* result = JSIteratorHelper::createWithInitialValues(vm, structure);
472-
RELEASE_ASSERT(materialization->properties().size() - 1 == JSIteratorHelper::numberOfInternalFields);
473-
return result;
474-
}
475-
case JSPromiseType: {
476-
if (structure->classInfoForCells() == JSInternalPromise::info()) {
477-
JSInternalPromise* result = JSInternalPromise::createWithInitialValues(vm, structure);
478-
RELEASE_ASSERT(materialization->properties().size() - 1 == JSInternalPromise::numberOfInternalFields);
479-
return result;
480-
}
474+
};
475+
476+
switch (structure->typeInfo().type()) {
477+
case JSArrayIteratorType:
478+
return create.operator()<JSArrayIterator>();
479+
case JSMapIteratorType:
480+
return create.operator()<JSMapIterator>();
481+
case JSSetIteratorType:
482+
return create.operator()<JSSetIterator>();
483+
case JSIteratorHelperType:
484+
return create.operator()<JSIteratorHelper>();
485+
case JSWrapForValidIteratorType:
486+
return create.operator()<JSWrapForValidIterator>();
487+
case JSAsyncFromSyncIteratorType:
488+
return create.operator()<JSAsyncFromSyncIterator>();
489+
case JSPromiseAllContextType:
490+
return create.operator()<JSPromiseAllContext>();
491+
case JSRegExpStringIteratorType:
492+
return create.operator()<JSRegExpStringIterator>();
493+
case JSPromiseType:
494+
if (structure->classInfoForCells() == JSInternalPromise::info())
495+
return create.operator()<JSInternalPromise>();
481496
ASSERT(structure->classInfoForCells() == JSPromise::info());
482-
JSPromise* result = JSPromise::createWithInitialValues(vm, structure);
483-
RELEASE_ASSERT(materialization->properties().size() - 1 == JSPromise::numberOfInternalFields);
484-
return result;
485-
}
497+
return create.operator()<JSPromise>();
486498
default:
487499
RELEASE_ASSERT_NOT_REACHED();
488500
return nullptr;

0 commit comments

Comments
 (0)