Title: [237215] trunk/Source/_javascript_Core
- Revision
- 237215
- Author
- mark....@apple.com
- Date
- 2018-10-16 21:16:24 -0700 (Tue, 16 Oct 2018)
Log Message
GetIndexedPropertyStorage can GC.
https://bugs.webkit.org/show_bug.cgi?id=190625
<rdar://problem/45309366>
Reviewed by Saam Barati.
This is because if the ArrayMode type is String, the DFG and FTL will be emitting
a call to operationResolveRope, and operationResolveRope can GC. This patch
updates doesGC() to reflect this.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (237214 => 237215)
--- trunk/Source/_javascript_Core/ChangeLog 2018-10-17 03:01:23 UTC (rev 237214)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-10-17 04:16:24 UTC (rev 237215)
@@ -1,3 +1,18 @@
+2018-10-16 Mark Lam <mark....@apple.com>
+
+ GetIndexedPropertyStorage can GC.
+ https://bugs.webkit.org/show_bug.cgi?id=190625
+ <rdar://problem/45309366>
+
+ Reviewed by Saam Barati.
+
+ This is because if the ArrayMode type is String, the DFG and FTL will be emitting
+ a call to operationResolveRope, and operationResolveRope can GC. This patch
+ updates doesGC() to reflect this.
+
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+
2018-10-16 Fujii Hironori <hironori.fu...@sony.com>
Unreviewed, rolling out r237188, r237189, and r237197.
Modified: trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp (237214 => 237215)
--- trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2018-10-17 03:01:23 UTC (rev 237214)
+++ trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2018-10-17 04:16:24 UTC (rev 237215)
@@ -250,7 +250,6 @@
case GetSetter:
case GetByVal:
case GetByValWithThis:
- case GetIndexedPropertyStorage:
case GetArrayLength:
case GetVectorLength:
case ArrayPush:
@@ -377,6 +376,11 @@
case MapSet:
return true;
+ case GetIndexedPropertyStorage:
+ if (node->arrayMode().type() == Array::String)
+ return true;
+ return false;
+
case MapHash:
switch (node->child1().useKind()) {
case BooleanUse:
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
