tree 7a68a8dc0c07b2f83b01d47e67dadc9fc9a828cd
parent ac6f99830016c7bf481617249819af59429a05a4
author mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571198478 +0000
committer mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571198478 +0000

operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
https://bugs.webkit.org/show_bug.cgi?id=202312
<rdar://problem/55782280>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
* stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
* stress/switch-on-char-llint-rope.js:
- Changed this test to make a new rope string for each iterations.  Otherwise,
  the rope will get resolved, and subsequent tiers will not be testing with a rope.

Source/JavaScriptCore:

operationSwitchCharWithUnknownKeyType() can only dispatch to a case handler
if the key string is of length 1.  All other cases should dispatch to the default
handler.  This patch also adds the missing OOME check.

Also fixed a bug in SpeculativeJIT::emitSwitchCharStringJump() where the slow
path rope resolution was returning after the length check.  It needs to return to
the point before the length check.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump):
* jit/JITOperations.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251178 268f45cc-cd09-0410-ab3c-d52691b4dbfc