[webkit-changes] [WebKit/WebKit] 22a4b3: [ARMv7][32bit] ASSERTION FAILED: CacheableIdentifi...

[Mikhail R. Gadelha]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 22a4b34d6231dea23bdbf492e0c24e133f4c6e5d
      https://github.com/WebKit/WebKit/commit/22a4b34d6231dea23bdbf492e0c24e133f4c6e5d
  Author: Mikhail R. Gadelha <mikhail at igalia.com>
  Date:   2022-09-27 (Tue, 27 Sep 2022)

  Changed paths:
    A JSTests/stress/get-private-name-cell.js
    M Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
    M Source/JavaScriptCore/bytecode/StructureStubInfo.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/jit/GPRInfo.h
    M Source/JavaScriptCore/jit/ICStats.h
    M Source/JavaScriptCore/jit/JITOperations.cpp

  Log Message:
  -----------
  [ARMv7][32bit] ASSERTION FAILED: CacheableIdentifier::isCacheableIdentifierCell(fieldNameValue)
https://bugs.webkit.org/show_bug.cgi?id=242640

Reviewed by Yusuke Suzuki.

This patch adds AccessType::GetPrivateNameById, the corresponding slow
path code, and changes compileGetPrivateNameById to use it when calling
cachedGetById.

The patch also includes some minor changes:
1. Adds default member initializer to StructureStubInfo
2. Rename argument names in JSValueRegs::withTwoAvailableRegs to be clearer
3. Fix typos in ICEVENT and where they are called

* JSTests/stress/get-private-name-cell.js: Added.
(__f_0):
(__v_0.0.__c_0.prototype.field.this.init.init):
(__v_0.0.__c_0.prototype.getField):
(__v_0.0.__c_0):
* Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::reset):
(JSC::slowOperationFromUnlinkedStructureStubInfo):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
* Source/JavaScriptCore/bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::StructureStubInfo):
(JSC::appropriateOptimizingGetByIdFunction):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/jit/GPRInfo.h:
(JSC::JSValueRegs::withTwoAvailableRegs):
(JSC::JSValueRegs::payloadOnly):
* Source/JavaScriptCore/jit/ICStats.h:
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):

Canonical link: https://commits.webkit.org/254938@main