56 lines
2.8 KiB
Diff
56 lines
2.8 KiB
Diff
|
From d44ded97d14cdb5ac2eb011203e5f4c45dfd94b9 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Yusuke Suzuki <ysuzuki@apple.com>
|
||
|
|
Date: Wed, 8 Feb 2023 15:32:00 -0800
|
||
|
|
Subject: [PATCH] Cherry-pick 1b2eb138ef92. rdar://problem/105236768
|
||
|
|
|
||
|
|
[JSC] ToThis object folding should check if AbstractValue is always an object
|
||
|
|
https://bugs.webkit.org/show_bug.cgi?id=251944
|
||
|
|
rdar://105175786
|
||
|
|
|
||
|
|
Reviewed by Geoffrey Garen and Mark Lam.
|
||
|
|
|
||
|
|
ToThis can become Identity for strict mode if it is just primitive values or its object does not have toThis function overriding.
|
||
|
|
This is correct, but folding ToThis to Undefined etc. (not Identity) needs to check that an input only contains objects.
|
||
|
|
This patch adds appropriate checks to prevent from converting ToThis(GlobalObject | Int32) to Undefined for example.
|
||
|
|
|
||
|
|
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
|
||
|
|
(JSC::DFG::isToThisAnIdentity):
|
||
|
|
|
||
|
|
Canonical link: https://commits.webkit.org/259548.63@safari-7615-branch
|
||
|
|
---
|
||
|
|
.../JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h | 9 +++++++--
|
||
|
|
1 file changed, 7 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
|
||
|
|
index ea7bcd6b7b31..ef3f6bbe376e 100644
|
||
|
|
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
|
||
|
|
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
|
||
|
|
@@ -209,7 +209,8 @@ inline ToThisResult isToThisAnIdentity(VM& vm, ECMAMode ecmaMode, AbstractValue&
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
- if ((ecmaMode.isStrict() || (valueForNode.m_type && !(valueForNode.m_type & ~SpecObject))) && valueForNode.m_structure.isFinite()) {
|
||
|
|
+ bool onlyObjects = valueForNode.m_type && !(valueForNode.m_type & ~SpecObject);
|
||
|
|
+ if ((ecmaMode.isStrict() || onlyObjects) && valueForNode.m_structure.isFinite()) {
|
||
|
|
bool allStructuresAreJSScope = !valueForNode.m_structure.isClear();
|
||
|
|
bool overridesToThis = false;
|
||
|
|
valueForNode.m_structure.forEach([&](RegisteredStructure structure) {
|
||
|
|
@@ -226,9 +227,13 @@ inline ToThisResult isToThisAnIdentity(VM& vm, ECMAMode ecmaMode, AbstractValue&
|
||
|
|
// If all the structures are JSScope's ones, we know the details of JSScope::toThis() operation.
|
||
|
|
allStructuresAreJSScope &= structure->classInfo()->methodTable.toThis == JSScope::info()->methodTable.toThis;
|
||
|
|
});
|
||
|
|
+
|
||
|
|
+ // This is correct for strict mode even if this can have non objects, since the right semantics is Identity.
|
||
|
|
if (!overridesToThis)
|
||
|
|
return ToThisResult::Identity;
|
||
|
|
- if (allStructuresAreJSScope) {
|
||
|
|
+
|
||
|
|
+ // But this folding is available only if input is always an object.
|
||
|
|
+ if (onlyObjects && allStructuresAreJSScope) {
|
||
|
|
if (ecmaMode.isStrict())
|
||
|
|
return ToThisResult::Undefined;
|
||
|
|
return ToThisResult::GlobalThis;
|
||
|
|
--
|
||
|
|
2.39.1
|
||
|
|
|