JIT::emit_op_iterator_next fast path passes in the wrong identifier to the "done" JITGetByIdGenerator

saambarati · saambarati · commit cc07f74a5ea2 · 2020-12-03T20:28:49.000Z
https://bugs.webkit.org/show_bug.cgi?id=219499 Reviewed by Keith Miller. The reason nothing was failing here is that the slow path which calls into C code to do repatching of the IC was using the right "done" identifier. The fast path only checks if the identifier is "length", so the code sidestepped itself being wrong in any way. However, it's good form to use the correct identifier. * jit/JITCall.cpp: (JSC::JIT::emit_op_iterator_next): Canonical link: https://commits.webkit.org/232087@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@270402 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,19 @@
+2020-12-03  Saam Barati  <sbarati@apple.com>
+
+        JIT::emit_op_iterator_next fast path passes in the wrong identifier to the "done" JITGetByIdGenerator
+        https://bugs.webkit.org/show_bug.cgi?id=219499
+
+        Reviewed by Keith Miller.
+
+        The reason nothing was failing here is that the slow path which calls into C
+        code to do repatching of the IC was using the right "done" identifier. The
+        fast path only checks if the identifier is "length", so the code sidestepped
+        itself being wrong in any way. However, it's good form to use the correct
+        identifier.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_iterator_next):
+
 2020-12-03  Lauro Moura  <lmoura@igalia.com>
 
         [WTF] Avoid JSONValue::create with raw string falling to bool overload
diff --git a/Source/JavaScriptCore/jit/JITCall.cpp b/Source/JavaScriptCore/jit/JITCall.cpp
@@ -482,7 +482,7 @@ void JIT::emit_op_iterator_next(const Instruction* instruction)
         preservedRegs.add(valueGPR);
         JITGetByIdGenerator gen(
             m_codeBlock, CodeOrigin(m_bytecodeIndex), CallSiteIndex(BytecodeIndex(m_bytecodeIndex.offset())), preservedRegs,
-            CacheableIdentifier::createFromImmortalIdentifier(vm().propertyNames->next.impl()), JSValueRegs(iterResultGPR), JSValueRegs(doneGPR), AccessType::GetById);
+            CacheableIdentifier::createFromImmortalIdentifier(vm().propertyNames->done.impl()), JSValueRegs(iterResultGPR), JSValueRegs(doneGPR), AccessType::GetById);
         gen.generateFastPath(*this);
         addSlowCase(gen.slowPathJump());
         m_getByIds.append(gen);
