compileCheckStringIdent in the FTL is wrong

https://bugs.webkit.org/show_bug.cgi?id=163215

Reviewed by Mark Lam and Filip Pizlo.

lowStringIdent() returns the StringImpl pointer. The compileCheckStringIdent()
was treating its return value as the actual JSString. This is wrong.

* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCheckStringIdent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@207017 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/stress/check-string-ident.js b/JSTests/stress/check-string-ident.js
new file mode 100644 (file)
index 0000000..7daee20
--- /dev/null
+++ b/JSTests/stress/check-string-ident.js
@@ -0,0 +1,15 @@
+//@ defaultNoEagerRun
+
+const o = { baz: 20 };
+function foo(p) {
+    o[p] = 20;
+}
+noInline(foo);
+noOSRExitFuzzing(foo);
+
+for (let i = 0; i < 1000000; i++) {
+    foo("baz");
+}
+
+if (numberOfDFGCompiles(foo) > 1)
+    throw new Error("We should not have to compile this function more than once.");

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 85a0083..eacda96 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2016-10-10  Saam Barati  <sbarati@apple.com>
+
+        compileCheckStringIdent in the FTL is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=163215
+
+        Reviewed by Mark Lam and Filip Pizlo.
+
+        lowStringIdent() returns the StringImpl pointer. The compileCheckStringIdent()
+        was treating its return value as the actual JSString. This is wrong.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckStringIdent):
+
 2016-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [DOMJIT] Implement Node accessors in DOMJIT

diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index a38629e..b5b6fc6 100644 (file)
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -2606,8 +2606,7 @@ private:
     void compileCheckStringIdent()
     {
         UniquedStringImpl* uid = m_node->uidOperand();
-        LValue string = lowStringIdent(m_node->child1());
-        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
+        LValue stringImpl = lowStringIdent(m_node->child1());
         speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
     }