Title: [228018] trunk/Source/_javascript_Core
- Revision
- 228018
- Author
- sbar...@apple.com
- Date
- 2018-02-02 11:07:31 -0800 (Fri, 02 Feb 2018)
Log Message
MapHash should return true to doesGC in the DFG depending on useKind because it might resolve a rope
https://bugs.webkit.org/show_bug.cgi?id=182402
Reviewed by Yusuke Suzuki.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (228017 => 228018)
--- trunk/Source/_javascript_Core/ChangeLog 2018-02-02 18:51:37 UTC (rev 228017)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-02-02 19:07:31 UTC (rev 228018)
@@ -1,3 +1,13 @@
+2018-02-02 Saam Barati <sbar...@apple.com>
+
+ MapHash should return true to doesGC in the DFG depending on useKind because it might resolve a rope
+ https://bugs.webkit.org/show_bug.cgi?id=182402
+
+ Reviewed by Yusuke Suzuki.
+
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+
2018-02-02 Yusuke Suzuki <utatane....@gmail.com>
[JSC] Clean up ArraySpeciesCreate
Modified: trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp (228017 => 228018)
--- trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2018-02-02 18:51:37 UTC (rev 228017)
+++ trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2018-02-02 19:07:31 UTC (rev 228018)
@@ -205,7 +205,6 @@
case CPUIntrinsic:
case CheckTraps:
case StringFromCharCode:
- case MapHash:
case NormalizeMapKey:
case GetMapBucket:
case GetMapBucketHead:
@@ -355,6 +354,18 @@
case SetAdd:
case MapSet:
return true;
+
+ case MapHash:
+ switch (node->child1().useKind()) {
+ case BooleanUse:
+ case Int32Use:
+ case SymbolUse:
+ case ObjectUse:
+ return false;
+ default:
+ // We might resolve a rope.
+ return true;
+ }
case MultiPutByOffset:
return node->multiPutByOffsetData().reallocatesStorage();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
