DFG::ByteCodeParser needs to null check the result of presenceLike()

https://bugs.webkit.org/show_bug.cgi?id=154135
rdar://problem/24291586

Reviewed by Geoffrey Garen.

ByteCodeParser::presenceLike() could return a null object property condition if it detects a
contradiction. That could happen due to bogus profiling. It's totally OK - we just need to
bail from using a property condition when that happens.

* bytecode/ObjectPropertyCondition.h:
(JSC::ObjectPropertyCondition::equivalence):
(JSC::ObjectPropertyCondition::operator bool):
(JSC::ObjectPropertyCondition::object):
(JSC::ObjectPropertyCondition::condition):
(JSC::ObjectPropertyCondition::operator!): Deleted.
* bytecode/PropertyCondition.h:
(JSC::PropertyCondition::equivalence):
(JSC::PropertyCondition::operator bool):
(JSC::PropertyCondition::kind):
(JSC::PropertyCondition::uid):
(JSC::PropertyCondition::operator!): Deleted.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::check):
(JSC::DFG::ByteCodeParser::load):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@196446 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index c447751..5b2f041 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,31 @@
+2016-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeParser needs to null check the result of presenceLike()
+        https://bugs.webkit.org/show_bug.cgi?id=154135
+        rdar://problem/24291586
+
+        Reviewed by Geoffrey Garen.
+
+        ByteCodeParser::presenceLike() could return a null object property condition if it detects a
+        contradiction. That could happen due to bogus profiling. It's totally OK - we just need to
+        bail from using a property condition when that happens.
+
+        * bytecode/ObjectPropertyCondition.h:
+        (JSC::ObjectPropertyCondition::equivalence):
+        (JSC::ObjectPropertyCondition::operator bool):
+        (JSC::ObjectPropertyCondition::object):
+        (JSC::ObjectPropertyCondition::condition):
+        (JSC::ObjectPropertyCondition::operator!): Deleted.
+        * bytecode/PropertyCondition.h:
+        (JSC::PropertyCondition::equivalence):
+        (JSC::PropertyCondition::operator bool):
+        (JSC::PropertyCondition::kind):
+        (JSC::PropertyCondition::uid):
+        (JSC::PropertyCondition::operator!): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::check):
+        (JSC::DFG::ByteCodeParser::load):
+
 2016-02-11  Benjamin Poulain  <benjamin@webkit.org>
 
         [JSC] SqrtFloat and CeilFloat also suffer from partial register stalls

diff --git a/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h b/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h
index 372e68a..4c2a9bd 100644 (file)
--- a/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h
+++ b/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -122,8 +122,8 @@ public:
             vm.heap.writeBarrier(owner);
         return equivalenceWithoutBarrier(object, uid, value);
     }
-    
-    bool operator!() const { return !m_condition; };
+
+    explicit operator bool() const { return !!m_condition; }
     
     JSObject* object() const { return m_object; }
     PropertyCondition condition() const { return m_condition; }

diff --git a/Source/JavaScriptCore/bytecode/PropertyCondition.h b/Source/JavaScriptCore/bytecode/PropertyCondition.h
index bd08c3b..1d5568f 100644 (file)
--- a/Source/JavaScriptCore/bytecode/PropertyCondition.h
+++ b/Source/JavaScriptCore/bytecode/PropertyCondition.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -125,8 +125,8 @@ public:
             vm.heap.writeBarrier(owner);
         return equivalenceWithoutBarrier(uid, value);
     }
-        
-    bool operator!() const { return !m_uid && m_kind == Presence; };
+    
+    explicit operator bool() const { return m_uid || m_kind != Presence; }
     
     Kind kind() const { return m_kind; }
     UniquedStringImpl* uid() const { return m_uid; }

diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index cdcd093..8eda439 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -2525,6 +2525,9 @@ Node* ByteCodeParser::handlePutByOffset(
 
 bool ByteCodeParser::check(const ObjectPropertyCondition& condition)
 {
+    if (!condition)
+        return false;
+    
     if (m_graph.watchCondition(condition))
         return true;
     
@@ -2772,14 +2775,15 @@ Node* ByteCodeParser::load(
 
                 ObjectPropertyCondition presenceCondition =
                     presenceLike(knownBase, uid, variant.offset(), variant.structureSet());
-
-                ObjectPropertyCondition equivalenceCondition =
-                    presenceCondition.attemptToMakeEquivalenceWithoutBarrier();
-                if (m_graph.watchCondition(equivalenceCondition))
-                    return weakJSConstant(equivalenceCondition.requiredValue());
-
-                if (check(presenceCondition))
-                    needStructureCheck = false;
+                if (presenceCondition) {
+                    ObjectPropertyCondition equivalenceCondition =
+                        presenceCondition.attemptToMakeEquivalenceWithoutBarrier();
+                    if (m_graph.watchCondition(equivalenceCondition))
+                        return weakJSConstant(equivalenceCondition.requiredValue());
+                    
+                    if (check(presenceCondition))
+                        needStructureCheck = false;
+                }
             }
         }
     }