delta/qt5/qtwebkit.git/Source/JavaScriptCore/dfg, branch 5.4.2 code.qt.io: qt/qtwebkit.git DFG optimizes out strict mode arguments tear off 2015-04-10T15:45:17+00:00 Filip Pizlo fpizlo@apple.com 2015-04-07T11:20:07+00:00 b653da9a88901fbc44114cac9232a6a332d2d0a7 https://bugs.webkit.org/show_bug.cgi?id=119504 Source/JavaScriptCore: Reviewed by Mark Hahnenberg and Oliver Hunt. Don't do the optimization for strict mode. * dfg/DFGArgumentsSimplificationPhase.cpp: (JSC::DFG::ArgumentsSimplificationPhase::run): (JSC::DFG::ArgumentsSimplificationPhase::pruneObviousArgumentCreations): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154217 268f45cc-cd09-0410-ab3c-d52691b4dbfc Change-Id: I68037df21deaa964ff18c4f168f465c2600627f7 Reviewed-by: Julien Brianceau <jbriance@cisco.com> Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com> 
https://bugs.webkit.org/show_bug.cgi?id=119504

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg and Oliver Hunt.

Don't do the optimization for strict mode.

* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
(JSC::DFG::ArgumentsSimplificationPhase::pruneObviousArgumentCreations):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154217 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: I68037df21deaa964ff18c4f168f465c2600627f7
Reviewed-by: Julien Brianceau <jbriance@cisco.com>
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
Fix crash in JIT::DFG::prepareOSREntry 2015-04-01T11:54:08+00:00 Julien Brianceau jbriance@cisco.com 2015-04-01T09:36:02+00:00 80471d52c85ab8edd1332e084b8bf46f44571c3b While verifying predictions in prepareOSREntry, locals could lay outside the stack in some cases. So we shouldn't retrieve jsValue from locals when we don't have to. Task-number: QTBUG-45299 Change-Id: I70003170348887128e11360fb501b69647194172 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@theqtcompany.com> 
While verifying predictions in prepareOSREntry, locals could lay
outside the stack in some cases. So we shouldn't retrieve jsValue
from locals when we don't have to.

Task-number: QTBUG-45299
Change-Id: I70003170348887128e11360fb501b69647194172
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@theqtcompany.com>
Incorrect type speculation reported by ToPrimitive 2015-03-11T14:07:41+00:00 Oliver Hunt oliver@apple.com 2015-03-11T13:07:35+00:00 a7f2e6bf8c1bc569c56d713894f442c7fed63264 https://bugs.webkit.org/show_bug.cgi?id=119458 Reviewed by Mark Hahnenberg. Make sure that we report the correct type possibilities for the output from ToPrimitive * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::::executeEffects): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153674 268f45cc-cd09-0410-ab3c-d52691b4dbfc Change-Id: I85d91598088ead350c89c4a9cc28a2bd866a2d22 Task-number: QTBUG-44912 Reviewed-by: Julien Brianceau <jbriance@cisco.com> Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com> 
https://bugs.webkit.org/show_bug.cgi?id=119458

Reviewed by Mark Hahnenberg.

Make sure that we report the correct type possibilities for the output
from ToPrimitive

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153674 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: I85d91598088ead350c89c4a9cc28a2bd866a2d22
Task-number: QTBUG-44912
Reviewed-by: Julien Brianceau <jbriance@cisco.com>
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
Merge remote-tracking branch 'origin/5.3' into 5.4 2014-10-31T14:06:58+00:00 Oswald Buddenhagen oswald.buddenhagen@digia.com 2014-10-31T14:06:52+00:00 14c77ecb6e56b3c3979ab612305fece60eb2be9b Change-Id: I11f35f205d2ded597d54650a948bec3e1e52b419 
Change-Id: I11f35f205d2ded597d54650a948bec3e1e52b419
Fix assert after makerope boundary check 2014-10-31T10:30:36+00:00 Lucas Forschler lforschler@apple.com 2014-10-22T13:05:00+00:00 0930236a6e8bef5c2b90f1522a06acf9dee9c15d The browser demo asserts on qt-project.org after the makerope security fix. Port of http://trac.webkit.org/changeset/169397 Change-Id: I19c98737735d9b17133742752928d4ce6349de13 Reviewed-by: Michael Bruning <michael.bruning@digia.com> 
The browser demo asserts on qt-project.org after the makerope security
fix.

Port of http://trac.webkit.org/changeset/169397

Change-Id: I19c98737735d9b17133742752928d4ce6349de13
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Merge remote-tracking branch 'origin/5.3' into 5.4 2014-10-14T12:08:44+00:00 Frederik Gladhorn frederik.gladhorn@theqtcompany.com 2014-10-14T12:08:44+00:00 5a45e3b78724563f05d62569d8ed31adc4ffd342 Change-Id: I509f0440296df39aece8133382aacc43a4e05f99 
Change-Id: I509f0440296df39aece8133382aacc43a4e05f99
DFG 32Bit: Crash loading "Classic" site @ translate.google.com 2014-09-30T09:21:10+00:00 Michael Saboff msaboff@apple.com 2014-09-29T14:56:20+00:00 3a65cdfd6a28193937b338d6cc74be20c3f8d25b https://bugs.webkit.org/show_bug.cgi?id=120015 Reviewed by Sam Weinig. * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::fillSpeculateCell): Added checks for spillFormat being DataFormatInteger or DataFormatDouble similar to what is in the 64 bit code and in all versions of fillSpeculateBoolean(). Change-Id: I4de21707f00c1538b82b9bee6b2acc2903611983 Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com> 
https://bugs.webkit.org/show_bug.cgi?id=120015

Reviewed by Sam Weinig.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell): Added checks for spillFormat being
DataFormatInteger or DataFormatDouble similar to what is in the 64 bit code and in
all versions of fillSpeculateBoolean().

Change-Id: I4de21707f00c1538b82b9bee6b2acc2903611983
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
compileMakeRope does not emit necessary bounds checks 2014-09-26T12:02:28+00:00 Filip Pizlo fpizlo@apple.com 2014-09-25T09:29:50+00:00 cf26dce826a7a6a2d14735c193c53b9103c4a369 https://bugs.webkit.org/show_bug.cgi?id=130684 <rdar://problem/16398388> Reviewed by Oliver Hunt. Add string length bounds checks in a bunch of places. We should never allow a string to have a length greater than 2^31-1 because it's not clear that the language has semantics for it and because there is code that assumes that this cannot happen. Also add a bunch of tests to that effect to cover the various ways in which this was previously allowed to happen. * dfg/DFGOperations.cpp: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileMakeRope): * ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::compileMakeRope): * runtime/JSString.cpp: (JSC::JSRopeString::RopeBuilder::expand): * runtime/JSString.h: (JSC::JSString::create): (JSC::JSRopeString::RopeBuilder::append): (JSC::JSRopeString::RopeBuilder::release): (JSC::JSRopeString::append): * runtime/Operations.h: (JSC::jsString): (JSC::jsStringFromRegisterArray): (JSC::jsStringFromArguments): * runtime/StringPrototype.cpp: (JSC::stringProtoFuncIndexOf): (JSC::stringProtoFuncSlice): (JSC::stringProtoFuncSubstring): (JSC::stringProtoFuncToLowerCase): * tests/stress/make-large-string-jit-strcat.js: Added. (foo): * tests/stress/make-large-string-jit.js: Added. (foo): * tests/stress/make-large-string-strcat.js: Added. * tests/stress/make-large-string.js: Added. Change-Id: If01dd2a2d2daa3d209eddf0213d2b391e94f54a0 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167336 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com> 
https://bugs.webkit.org/show_bug.cgi?id=130684
<rdar://problem/16398388>

Reviewed by Oliver Hunt.

Add string length bounds checks in a bunch of places. We should never allow a string
to have a length greater than 2^31-1 because it's not clear that the language has
semantics for it and because there is code that assumes that this cannot happen.

Also add a bunch of tests to that effect to cover the various ways in which this was
previously allowed to happen.

* dfg/DFGOperations.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileMakeRope):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMakeRope):
* runtime/JSString.cpp:
(JSC::JSRopeString::RopeBuilder::expand):
* runtime/JSString.h:
(JSC::JSString::create):
(JSC::JSRopeString::RopeBuilder::append):
(JSC::JSRopeString::RopeBuilder::release):
(JSC::JSRopeString::append):
* runtime/Operations.h:
(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
* tests/stress/make-large-string-jit-strcat.js: Added.
(foo):
* tests/stress/make-large-string-jit.js: Added.
(foo):
* tests/stress/make-large-string-strcat.js: Added.
* tests/stress/make-large-string.js: Added.

Change-Id: If01dd2a2d2daa3d209eddf0213d2b391e94f54a0
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167336 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
REGRESSION: Crash when opening Facebook.com 2014-09-25T09:38:07+00:00 Oliver Hunt oliver@apple.com 2014-09-24T16:46:55+00:00 fffb502f202586d7029385595a84142937499bd6 https://bugs.webkit.org/show_bug.cgi?id=119155 Reviewed by Andreas Kling. Scope nodes are always objects, so we should be using SpecObjectOther rather than SpecCellOther. Marking Scopes as CellOther leads to a contradiction in the CFA, resulting in bogus codegen. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::::executeEffects): * dfg/DFGPredictionPropagationPhase.cpp: (JSC::DFG::PredictionPropagationPhase::propagate): Change-Id: Ic083c04b9351c904ea4b5ee41bcc98c7d66d757d git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153410 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com> 
https://bugs.webkit.org/show_bug.cgi?id=119155

Reviewed by Andreas Kling.

Scope nodes are always objects, so we should be using SpecObjectOther
rather than SpecCellOther.  Marking Scopes as CellOther leads to a
contradiction in the CFA, resulting in bogus codegen.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):

Change-Id: Ic083c04b9351c904ea4b5ee41bcc98c7d66d757d
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153410 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Incorrect behavior on emscripten-compiled cube2hash 2014-09-24T17:35:51+00:00 Filip Pizlo fpizlo@apple.com 2014-09-24T16:43:29+00:00 f69ddfaa6d06e0c209365835ad7590e9c18f5103 https://bugs.webkit.org/show_bug.cgi?id=120033 Source/JavaScriptCore: Reviewed by Mark Hahnenberg. If PutClosureVar is may-aliased to another PutClosureVar or GetClosureVar then we should bail attempts to CSE. * dfg/DFGCSEPhase.cpp: (JSC::DFG::CSEPhase::scopedVarLoadElimination): (JSC::DFG::CSEPhase::scopedVarStoreElimination): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154344 268f45cc-cd09-0410-ab3c-d52691b4dbfc Task-number: QTBUG-41500 Change-Id: Ia6bd7b09b20a99d5f4b5a14bf58737bc4b8c6a2b Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com> 
https://bugs.webkit.org/show_bug.cgi?id=120033

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

If PutClosureVar is may-aliased to another PutClosureVar or GetClosureVar
then we should bail attempts to CSE.

* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::scopedVarLoadElimination):
(JSC::DFG::CSEPhase::scopedVarStoreElimination):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154344 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Task-number: QTBUG-41500
Change-Id: Ia6bd7b09b20a99d5f4b5a14bf58737bc4b8c6a2b
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>