[Builtins] New Array.prototype.filter implementation observability bug.

src/builtins/builtins-array-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 110 matching lines @@
                 SmiConstant(MessageTemplate::kReduceNoInitial));
     Unreachable();
     Bind(&ok);
   }
 
   Node* FilterResultGenerator() {
     // 7. Let A be ArraySpeciesCreate(O, 0).
     return ArraySpeciesCreate(context(), o(), SmiConstant(0));
   }
 
-  void FilterResultIndexReinitializer() {
-    Variable merged_length(this, MachineRepresentation::kTagged);
-    Label has_length(this, &merged_length), not_js_array(this);
-    GotoIf(DoesntHaveInstanceType(a(), JS_ARRAY_TYPE), &not_js_array);
-    merged_length.Bind(LoadJSArrayLength(a()));
-    Goto(&has_length);
-    Bind(&not_js_array);
-    Node* len_property =
-        GetProperty(context(), a(), isolate()->factory()->length_string());
-    merged_length.Bind(
-        CallStub(CodeFactory::ToLength(isolate()), context(), len_property));
-    Goto(&has_length);
-    Bind(&has_length);
-    Node* len = merged_length.value();
-
-    to_.Bind(len);
-  }
-
   Node* FilterProcessor(Node* k_value, Node* k) {
     Node* callback_result = CallJS(CodeFactory::Call(isolate()), context(),
                                    callbackfn(), this_arg(), k_value, k, o());
     Label true_continue(this, &to_), false_continue(this);
     BranchIfToBooleanIsTrue(callback_result, &true_continue, &false_continue);
     Bind(&true_continue);
 
     // 1. let status be CreateDataPropertyOrThrow(A, ToString(to), kValue).
     // 2. ReturnIfAbrupt(status)
     Node* const p_to = ToString(context(), to_.value());
     CallRuntime(Runtime::kCreateDataProperty, context(), a(), p_to, k_value);
 
     // 3. Increase to by 1.
     to_.Bind(NumberInc(to_.value()));
     Goto(&false_continue);
     Bind(&false_continue);
     return a();
   }
 
   void NullPostLoopAction() {}
 
-  void NullResultIndexReinitializer() {}
-
  protected:
   Node* context() { return context_; }
   Node* receiver() { return receiver_; }
   Node* new_target() { return new_target_; }
   Node* o() { return o_; }
   Node* len() { return len_; }
   Node* callbackfn() { return callbackfn_; }
   Node* this_arg() { return this_arg_; }
   Node* k() { return k_.value(); }
   Node* a() { return a_.value(); }
@@ skipping 84 matching lines @@
     HandleFastElements(processor, action, &slow);
 
     Bind(&slow);
 
     Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
                                  MachineType::TaggedPointer());
     TailCallStub(
         slow_case_continuation, context(), target, new_target(),
         Int32Constant(IteratingArrayBuiltinLoopContinuationDescriptor::kArity),
         receiver(), callbackfn(), this_arg(), a_.value(), o(), k_.value(),
-        len());
+        len(), to_.value());
   }
 
   void InitIteratingArrayBuiltinLoopContinuation(Node* context, Node* receiver,
                                                  Node* callbackfn,
                                                  Node* this_arg, Node* a,
                                                  Node* o, Node* initial_k,
-                                                 Node* len) {
+                                                 Node* len, Node* to) {
     context_ = context;
     this_arg_ = this_arg;
     callbackfn_ = callbackfn;
     a_.Bind(a);
     k_.Bind(initial_k);
     o_ = o;
     len_ = len;
+    to_.Bind(to);
   }
 
   void GenerateIteratingArrayBuiltinLoopContinuation(
-      const BuiltinResultIndexInitializer& index_initializer,
       const CallResultProcessor& processor, const PostLoopAction& action) {
-    index_initializer(this);
-
     // 8. Repeat, while k < len
     Label loop(this, {&k_, &a_, &to_});
     Label after_loop(this);
     Goto(&loop);
     Bind(&loop);
     {
       GotoUnlessNumberLessThan(k(), len_, &after_loop);
 
       Label done_element(this, &to_);
       // a. Let Pk be ToString(k).
@@ skipping 303 matching lines @@
 
 TF_BUILTIN(ArrayForEachLoopContinuation, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* object = Parameter(Descriptor::kObject);
   Node* initial_k = Parameter(Descriptor::kInitialK);
   Node* len = Parameter(Descriptor::kLength);
+  Node* to = Parameter(Descriptor::kTo);
 
-  InitIteratingArrayBuiltinLoopContinuation(
-      context, receiver, callbackfn, this_arg, array, object, initial_k, len);
+  InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
+                                            this_arg, array, object, initial_k,
+                                            len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::NullResultIndexReinitializer,
       &ArrayBuiltinCodeStubAssembler::ForEachProcessor,
       &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
 }
 
 TF_BUILTIN(ArrayForEach, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* new_target = Parameter(Descriptor::kNewTarget);
@@ skipping 11 matching lines @@
 
 TF_BUILTIN(ArraySomeLoopContinuation, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* object = Parameter(Descriptor::kObject);
   Node* initial_k = Parameter(Descriptor::kInitialK);
   Node* len = Parameter(Descriptor::kLength);
+  Node* to = Parameter(Descriptor::kTo);
 
-  InitIteratingArrayBuiltinLoopContinuation(
-      context, receiver, callbackfn, this_arg, array, object, initial_k, len);
+  InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
+                                            this_arg, array, object, initial_k,
+                                            len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::NullResultIndexReinitializer,
       &ArrayBuiltinCodeStubAssembler::SomeProcessor,
       &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
 }
 
 TF_BUILTIN(ArraySome, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* new_target = Parameter(Descriptor::kNewTarget);
@@ skipping 11 matching lines @@
 
 TF_BUILTIN(ArrayEveryLoopContinuation, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* object = Parameter(Descriptor::kObject);
   Node* initial_k = Parameter(Descriptor::kInitialK);
   Node* len = Parameter(Descriptor::kLength);
+  Node* to = Parameter(Descriptor::kTo);
 
-  InitIteratingArrayBuiltinLoopContinuation(
-      context, receiver, callbackfn, this_arg, array, object, initial_k, len);
+  InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
+                                            this_arg, array, object, initial_k,
+                                            len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::NullResultIndexReinitializer,
       &ArrayBuiltinCodeStubAssembler::EveryProcessor,
       &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
 }
 
 TF_BUILTIN(ArrayEvery, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* new_target = Parameter(Descriptor::kNewTarget);
@@ skipping 11 matching lines @@
 
 TF_BUILTIN(ArrayReduceLoopContinuation, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* accumulator = Parameter(Descriptor::kAccumulator);
   Node* object = Parameter(Descriptor::kObject);
   Node* initial_k = Parameter(Descriptor::kInitialK);
   Node* len = Parameter(Descriptor::kLength);
+  Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
                                             this_arg, accumulator, object,
-                                            initial_k, len);
+                                            initial_k, len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::NullResultIndexReinitializer,
       &ArrayBuiltinCodeStubAssembler::ReduceProcessor,
       &ArrayBuiltinCodeStubAssembler::ReducePostLoopAction);
 }
 
 TF_BUILTIN(ArrayReduce, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* initial_value = Parameter(Descriptor::kInitialValue);
   Node* new_target = Parameter(Descriptor::kNewTarget);
@@ skipping 11 matching lines @@
 
 TF_BUILTIN(ArrayFilterLoopContinuation, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* object = Parameter(Descriptor::kObject);
   Node* initial_k = Parameter(Descriptor::kInitialK);
   Node* len = Parameter(Descriptor::kLength);
+  Node* to = Parameter(Descriptor::kTo);
 
-  InitIteratingArrayBuiltinLoopContinuation(
-      context, receiver, callbackfn, this_arg, array, object, initial_k, len);
+  InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
+                                            this_arg, array, object, initial_k,
+                                            len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::FilterResultIndexReinitializer,
       &ArrayBuiltinCodeStubAssembler::FilterProcessor,
       &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
 }
 
 TF_BUILTIN(ArrayFilter, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* new_target = Parameter(Descriptor::kNewTarget);
@@ skipping 1063 matching lines @@
   {
     Node* message = SmiConstant(MessageTemplate::kDetachedOperation);
     CallRuntime(Runtime::kThrowTypeError, context, message,
                 HeapConstant(operation));
     Unreachable();
   }
 }
 
 }  // namespace internal
 }  // namespace v8