tree 153a209b431cc869fdceab47263759bb024f13c3
parent 19dc02dd92135911cc4393d06977a1f3dac202e2
author mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1544070867 +0000
committer mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1544070867 +0000

speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
https://bugs.webkit.org/show_bug.cgi?id=192441
<rdar://problem/46480355>

Reviewed by Saam Barati.

JSTests:

* stress/regress-192441.js: Added.

Source/JavaScriptCore:

This is because a regular String (non-Identifier) can be converted into an
Identifier.  During DFG/FTL compilation, AbstractValue::checkConsistency() may
expect a value to be of type SpecStringVar, but the mutator thread may have
converted the string into an Identifier.  This creates a race where
AbstractValue::checkConsistency() may fail because it sees a SpecStringIdent when
it expects the a SpecStringVar.

The fix is to speculate non-Identifier strings as type SpecString which allows it
to be SpecStringVar or SpecStringIndent.

* bytecode/SpeculatedType.cpp:
(JSC::speculationFromCell):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@238923 268f45cc-cd09-0410-ab3c-d52691b4dbfc