449978 - TM: trace some more builtins for string-validate-input

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Robert Sayre]

Adding Math.floor and String.charAt helps, though we still bail on most loops because of failing to trace LT/GT with string operands.

before:

recorder: started(38), aborted(38), completed(0), different header(12), trees trashed(38), slot promoted(0), unstable loop variable(0)
monitor: triggered(0), exits (0), type mismatch(0), global mismatch(0)

after:

recorder: started(33), aborted(30), completed(3), different header(13), trees trashed(31), slot promoted(1), unstable loop variable(1)
monitor: triggered(7999), exits (4000), type mismatch(3998), global mismatch(1)

Comment 1

[Robert Sayre]

Attachment: add Math.floor and String.charAt to knownNatives

Comment 2

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 333120 [details] [diff] [review]
add Math.floor and String.charAt to knownNatives

>+JSString* FASTCALL
>+builtin_String_p_charAt(JSContext* cx, JSString* str, jsint i)
>+{
>+    return builtin_String_getelem(cx, str, i);   
> }

Might as well just use builtin_String_getelem here, save a bit of code size.

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 333120 [details] [diff] [review]
add Math.floor and String.charAt to knownNatives

>         { js_math_sin,         F_Math_sin,             "",    "d",    INFALLIBLE, },
>         { js_math_cos,         F_Math_cos,             "",    "d",    INFALLIBLE, },
>         { js_math_pow,         F_Math_pow,             "",   "dd",    INFALLIBLE, },
>         { js_math_sqrt,        F_Math_sqrt,            "",    "d",    INFALLIBLE, },
>+        { js_math_floor,       F_Math_floor,           "",    "d",    INFALLIBLE, },
>         { js_str_substring,    F_String_p_substring,   "TC", "ii",    FAIL_NULL, },
>         { js_str_substring,    F_String_p_substring_1, "TC",  "i",    FAIL_NULL, },
>         { js_str_fromCharCode, F_String_fromCharCode,  "C",   "i",    FAIL_NULL, },
>         { js_str_charCodeAt,   F_String_p_charCodeAt,  "T",   "i",    FAIL_NEG, },
>-        { js_math_random,      F_Math_random,          "R",    "",    INFALLIBLE, }
>+        { js_str_charAt,       F_String_p_charAt,      "C",   "i",    FAIL_NULL, },
>+        { js_math_random,      F_Math_random,          "R",    "",    INFALLIBLE, },
>     };

Missed this until Rob mentioned a crash: String_p_charAt wants "TC", "i", I think -- like js_str_substring_1 -- since it wants to see (JSContext, JSString (this), jsint).

Comment 4

[Robert Sayre]

http://hg.mozilla.org/index.cgi/tracemonkey/rev/ce02fcaa233d