chakra-core
diff --git a/‎Build/Chakra.Build.props
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎Build/Chakra.Build.props
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
diff --git a/‎Build/Common.Build.Default.props
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎Build/Common.Build.Default.props
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
diff --git a/‎Build/Common.Build.props
Copy file name to clipboard
+3Lines changed: 3 additions & 0 deletions b/‎Build/Common.Build.props
Copy file name to clipboard
+3Lines changed: 3 additions & 0 deletions
diff --git a/‎lib/Backend/AsmJsJITInfo.cpp
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/‎lib/Backend/AsmJsJITInfo.cpp
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/‎lib/Backend/AsmJsJITInfo.h
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/‎lib/Backend/AsmJsJITInfo.h
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/‎lib/Backend/CodeGenWorkItem.h
Copy file name to clipboard
+7Lines changed: 7 additions & 0 deletions b/‎lib/Backend/CodeGenWorkItem.h
Copy file name to clipboard
+7Lines changed: 7 additions & 0 deletions
diff --git a/‎lib/Backend/Func.cpp
Copy file name to clipboard
+8Lines changed: 8 additions & 0 deletions b/‎lib/Backend/Func.cpp
Copy file name to clipboard
+8Lines changed: 8 additions & 0 deletions
diff --git a/‎lib/Backend/IR.cpp
Copy file name to clipboard
+6Lines changed: 6 additions & 0 deletions b/‎lib/Backend/IR.cpp
Copy file name to clipboard
+6Lines changed: 6 additions & 0 deletions
diff --git a/‎lib/Backend/IR.h
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎lib/Backend/IR.h
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
diff --git a/‎lib/Backend/IRBuilder.cpp
Copy file name to clipboard
+4-1Lines changed: 4 additions & 1 deletion b/‎lib/Backend/IRBuilder.cpp
Copy file name to clipboard
+4-1Lines changed: 4 additions & 1 deletion
@@ -4,6 +4,7 @@
   <PropertyGroup>
     <Win32_WinNTVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_Win7)'">0x0601</Win32_WinNTVersion>
     <Win32_WinNTVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_Win8)'">0x0602</Win32_WinNTVersion>
+    <Win32_WinNTVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_WinBlue)'">0x0603</Win32_WinNTVersion>
     <Win32_WinNTVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_Win10)'">0x0A00</Win32_WinNTVersion>
   </PropertyGroup>
   <PropertyGroup>
 
@@ -4,6 +4,7 @@
   <PropertyGroup>
     <NtTargetVersion_Win7 >0x601</NtTargetVersion_Win7>
     <NtTargetVersion_Win8 >0x602</NtTargetVersion_Win8>
+    <NtTargetVersion_WinBlue>0x603</NtTargetVersion_WinBlue>
     <NtTargetVersion_Win10>0xA00</NtTargetVersion_Win10>
   </PropertyGroup>
 
 
@@ -29,6 +29,8 @@
       <!-- ======== sources.inc ======== -->
       <!-- generates SAL annotations for our interface -->
       <AdditionalOptions>%(AdditionalOptions) -sal_local</AdditionalOptions>
+      
+      <PreprocessorDefinitions>%(PreprocessorDefinitions);WINVER=$(Win32_WinNTVersion)</PreprocessorDefinitions>
     </Midl>
     <ClCompile>
       <PreprocessorDefinitions>%(PreprocessorDefinitions);NOMINMAX;USE_EDGEMODE_JSRT</PreprocessorDefinitions>
@@ -105,6 +107,7 @@
 
       <MinimumRequiredVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_Win7)'" >6.1</MinimumRequiredVersion>
       <MinimumRequiredVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_Win8)'" >6.2</MinimumRequiredVersion>
+      <MinimumRequiredVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_WinBlue)'" >6.3</MinimumRequiredVersion>
       <MinimumRequiredVersion Condition="'$(NtTargetVersion)'=='$(NtTargetVersion_Win10)'" >10.00</MinimumRequiredVersion>
 
       <!-- Always set the checksum -->
 
@@ -60,7 +60,7 @@ AsmJsJITInfo::GetArgTypeArray() const
 Js::AsmJsVarType::Which
 AsmJsJITInfo::GetArgType(Js::ArgSlot argNum) const
 {
-    Assert(argNum < GetArgCount());
+    AssertOrFailFast(argNum < GetArgCount());
     return GetArgTypeArray()[argNum];
 }
 
 
@@ -28,7 +28,6 @@ class AsmJsJITInfo
     Js::ArgSlot GetArgCount() const;
     Js::ArgSlot GetArgByteSize() const;
     Js::AsmJsRetType::Which GetRetType() const;
-    Js::AsmJsVarType::Which * GetArgTypeArray() const;
     Js::AsmJsVarType::Which GetArgType(Js::ArgSlot argNum) const;
 
 #ifdef ENABLE_WASM
@@ -40,6 +39,7 @@ class AsmJsJITInfo
     bool AccessNeedsBoundCheck(uint offset) const;
 
 private:
+    Js::AsmJsVarType::Which * GetArgTypeArray() const;
     AsmJsDataIDL m_data;
 #endif
 };
@@ -58,6 +58,13 @@ struct CodeGenWorkItem : public JsUtil::Job
         return functionBody->GetScriptContext();
     }
 
+    uint GetByteCodeLength() const
+    {
+        return this->functionBody->IsInDebugMode()
+            ? this->functionBody->GetOriginalByteCode()->GetLength()
+            : this->functionBody->GetByteCode()->GetLength();
+    }
+
     Js::FunctionBody* GetFunctionBody() const
     {
         return functionBody;
 
@@ -153,6 +153,14 @@ Func::Func(JitArenaAllocator *alloc, JITTimeWorkItem * workItem,
 
     Assert(this->IsInlined() == !!runtimeInfo);
 
+    AssertOrFailFast(!HasProfileInfo() || GetReadOnlyProfileInfo()->GetLoopCount() == GetJITFunctionBody()->GetLoopCount());
+    Js::RegSlot tmpResult;
+    AssertOrFailFast(!UInt32Math::Add(GetJITFunctionBody()->GetConstCount(), GetJITFunctionBody()->GetVarCount(), &tmpResult));
+    AssertOrFailFast(GetJITFunctionBody()->IsAsmJsMode() || GetJITFunctionBody()->GetFirstTmpReg() <= GetJITFunctionBody()->GetLocalsCount());
+    AssertOrFailFast(!IsLoopBody() || m_workItem->GetLoopNumber() < GetJITFunctionBody()->GetLoopCount());
+    AssertOrFailFast(CONFIG_FLAG(Prejit) || CONFIG_ISENABLED(Js::ForceNativeFlag) || GetJITFunctionBody()->GetByteCodeLength() < (uint)CONFIG_FLAG(MaxJITFunctionBytecodeByteLength));
+    GetJITFunctionBody()->EnsureConsistentConstCount();
+
     if (this->IsTopFunc())
     {
         outputData->hasJittedStackClosure = false;
 
@@ -84,6 +84,12 @@ Instr::HasEquivalentTypeCheckBailOut() const
     return this->HasBailOutInfo() && IR::IsEquivalentTypeCheckBailOutKind(this->GetBailOutKind());
 }
 
+bool
+Instr::HasBailOnNoProfile() const
+{
+    return this->HasBailOutInfo() && this->GetBailOutKind() == IR::BailOutOnNoProfile;
+}
+
 void
 Instr::ChangeEquivalentToMonoTypeCheckBailOut()
 {
 
@@ -203,6 +203,7 @@ class Instr
     bool            HasAuxBailOut() const { return hasAuxBailOut; }
     bool            HasTypeCheckBailOut() const;
     bool            HasEquivalentTypeCheckBailOut() const;
+    bool            HasBailOnNoProfile() const;
     void            ClearBailOutInfo();
     bool            IsDstNotAlwaysConvertedToInt32() const;
     bool            IsDstNotAlwaysConvertedToNumber() const;
 
@@ -400,7 +400,7 @@ IRBuilder::Build()
     Js::RegSlot tempCount = m_func->GetJITFunctionBody()->GetTempCount();
     if (tempCount > 0)
     {
-        this->tempMap = (SymID*)m_tempAlloc->AllocZero(sizeof(SymID) * tempCount);
+        this->tempMap = AnewArrayZ(m_tempAlloc, SymID, tempCount);
         this->fbvTempUsed = BVFixed::New<JitArenaAllocator>(tempCount, m_tempAlloc);
     }
     else
@@ -446,6 +446,7 @@ IRBuilder::Build()
 #endif
 
         lastOffset = m_func->m_workItem->GetLoopHeader()->endOffset;
+        AssertOrFailFast(lastOffset < m_func->GetJITFunctionBody()->GetByteCodeLength());
         // Ret is created at lastOffset + 1, so we need lastOffset + 2 entries
         offsetToInstructionCount = lastOffset + 2;
 
@@ -2721,6 +2722,7 @@ IRBuilder::BuildUnsigned1(Js::OpCode newOpcode, uint32 offset, uint32 num)
 
         case Js::OpCode::ProfiledLoopStart:
         {
+            AssertOrFailFast(num < m_func->GetJITFunctionBody()->GetLoopCount());
             // If we're in profiling SimpleJit and jitting loop bodies, we need to keep this until lowering.
             if (m_func->DoSimpleJitDynamicProfile() && m_func->GetJITFunctionBody()->DoJITLoopBody())
             {
@@ -2771,6 +2773,7 @@ IRBuilder::BuildUnsigned1(Js::OpCode newOpcode, uint32 offset, uint32 num)
 
         case Js::OpCode::ProfiledLoopEnd:
         {
+            AssertOrFailFast(num < m_func->GetJITFunctionBody()->GetLoopCount());
             // TODO: Decide whether we want the implicit loop call flags to be recorded in simplejitted loop bodies
             if (m_func->DoSimpleJitDynamicProfile() && m_func->GetJITFunctionBody()->DoJITLoopBody())
             {
Original file line number	Diff line number	Diff line change
`@@ -60,7 +60,7 @@ AsmJsJITInfo::GetArgTypeArray() const`
`60`	`60`	`Js::AsmJsVarType::Which`
`61`	`61`	`AsmJsJITInfo::GetArgType(Js::ArgSlot argNum) const`
`62`	`62`	`{`
`63`		`- Assert(argNum < GetArgCount());`
	`63`	`+ AssertOrFailFast(argNum < GetArgCount());`
`64`	`64`	`return GetArgTypeArray()[argNum];`
`65`	`65`	`}`
`66`	`66`
Original file line number	Diff line number	Diff line change
`@@ -58,6 +58,13 @@ struct CodeGenWorkItem : public JsUtil::Job`
`58`	`58`	`return functionBody->GetScriptContext();`
`59`	`59`	`}`
`60`	`60`
	`61`	`+ uint GetByteCodeLength() const`
	`62`	`+ {`
	`63`	`+ return this->functionBody->IsInDebugMode()`
	`64`	`+ ? this->functionBody->GetOriginalByteCode()->GetLength()`
	`65`	`+ : this->functionBody->GetByteCode()->GetLength();`
	`66`	`+ }`
	`67`	`+`
`61`	`68`	`Js::FunctionBody* GetFunctionBody() const`
`62`	`69`	`{`
`63`	`70`	`return functionBody;`
Original file line number	Diff line number	Diff line change
`@@ -84,6 +84,12 @@ Instr::HasEquivalentTypeCheckBailOut() const`
`84`	`84`	`return this->HasBailOutInfo() && IR::IsEquivalentTypeCheckBailOutKind(this->GetBailOutKind());`
`85`	`85`	`}`
`86`	`86`
	`87`	`+bool`
	`88`	`+Instr::HasBailOnNoProfile() const`
	`89`	`+{`
	`90`	`+ return this->HasBailOutInfo() && this->GetBailOutKind() == IR::BailOutOnNoProfile;`
	`91`	`+}`
	`92`	`+`
`87`	`93`	`void`
`88`	`94`	`Instr::ChangeEquivalentToMonoTypeCheckBailOut()`
`89`	`95`	`{`
Original file line number	Diff line number	Diff line change
`@@ -400,7 +400,7 @@ IRBuilder::Build()`
`400`	`400`	`Js::RegSlot tempCount = m_func->GetJITFunctionBody()->GetTempCount();`
`401`	`401`	`if (tempCount > 0)`
`402`	`402`	`{`
`403`		`- this->tempMap = (SymID)m_tempAlloc->AllocZero(sizeof(SymID) tempCount);`
	`403`	`+ this->tempMap = AnewArrayZ(m_tempAlloc, SymID, tempCount);`
`404`	`404`	`this->fbvTempUsed = BVFixed::New<JitArenaAllocator>(tempCount, m_tempAlloc);`
`405`	`405`	`}`
`406`	`406`	`else`
`@@ -446,6 +446,7 @@ IRBuilder::Build()`
`446`	`446`	`#endif`
`447`	`447`
`448`	`448`	`lastOffset = m_func->m_workItem->GetLoopHeader()->endOffset;`
	`449`	`+ AssertOrFailFast(lastOffset < m_func->GetJITFunctionBody()->GetByteCodeLength());`
`449`	`450`	`// Ret is created at lastOffset + 1, so we need lastOffset + 2 entries`
`450`	`451`	`offsetToInstructionCount = lastOffset + 2;`
`451`	`452`
`@@ -2721,6 +2722,7 @@ IRBuilder::BuildUnsigned1(Js::OpCode newOpcode, uint32 offset, uint32 num)`
`2721`	`2722`
`2722`	`2723`	`case Js::OpCode::ProfiledLoopStart:`
`2723`	`2724`	`{`
	`2725`	`+ AssertOrFailFast(num < m_func->GetJITFunctionBody()->GetLoopCount());`
`2724`	`2726`	`// If we're in profiling SimpleJit and jitting loop bodies, we need to keep this until lowering.`
`2725`	`2727`	`if (m_func->DoSimpleJitDynamicProfile() && m_func->GetJITFunctionBody()->DoJITLoopBody())`
`2726`	`2728`	`{`
`@@ -2771,6 +2773,7 @@ IRBuilder::BuildUnsigned1(Js::OpCode newOpcode, uint32 offset, uint32 num)`
`2771`	`2773`
`2772`	`2774`	`case Js::OpCode::ProfiledLoopEnd:`
`2773`	`2775`	`{`
	`2776`	`+ AssertOrFailFast(num < m_func->GetJITFunctionBody()->GetLoopCount());`
`2774`	`2777`	`// TODO: Decide whether we want the implicit loop call flags to be recorded in simplejitted loop bodies`
`2775`	`2778`	`if (m_func->DoSimpleJitDynamicProfile() && m_func->GetJITFunctionBody()->DoJITLoopBody())`
`2776`	`2779`	`{`