Title: [242810] trunk
- Revision
- 242810
- Author
- [email protected]
- Date
- 2019-03-12 12:02:22 -0700 (Tue, 12 Mar 2019)
Log Message
The HasIndexedProperty node does GC.
https://bugs.webkit.org/show_bug.cgi?id=195559
<rdar://problem/48767923>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/HasIndexedProperty-does-gc.js: Added.
Source/_javascript_Core:
HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
which can eventually call JSString::getIndex(), which can resolve a rope.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (242809 => 242810)
--- trunk/JSTests/ChangeLog 2019-03-12 18:59:29 UTC (rev 242809)
+++ trunk/JSTests/ChangeLog 2019-03-12 19:02:22 UTC (rev 242810)
@@ -1,3 +1,13 @@
+2019-03-12 Mark Lam <[email protected]>
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/HasIndexedProperty-does-gc.js: Added.
+
2019-03-11 Caio Lima <[email protected]>
[ESNext][BigInt] Implement "~" unary operation
Added: trunk/JSTests/stress/HasIndexedProperty-does-gc.js (0 => 242810)
--- trunk/JSTests/stress/HasIndexedProperty-does-gc.js (rev 0)
+++ trunk/JSTests/stress/HasIndexedProperty-does-gc.js 2019-03-12 19:02:22 UTC (rev 242810)
@@ -0,0 +1,9 @@
+// This test should not crash.
+function foo(a) {
+ return 0 in a;
+}
+for (let i = 0; i < 100000; i++) {
+ const str = new String('asdf');
+ str[42] = 'x'; // Give it ArrayStorage
+ foo(str);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (242809 => 242810)
--- trunk/Source/_javascript_Core/ChangeLog 2019-03-12 18:59:29 UTC (rev 242809)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-03-12 19:02:22 UTC (rev 242810)
@@ -1,3 +1,17 @@
+2019-03-12 Mark Lam <[email protected]>
+
+ The HasIndexedProperty node does GC.
+ https://bugs.webkit.org/show_bug.cgi?id=195559
+ <rdar://problem/48767923>
+
+ Reviewed by Yusuke Suzuki.
+
+ HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+ which can eventually call JSString::getIndex(), which can resolve a rope.
+
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+
2019-03-12 Devin Rousso <[email protected]>
Web Inspector: Audit: there should be a centralized place for reusable code
Modified: trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp (242809 => 242810)
--- trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2019-03-12 18:59:29 UTC (rev 242809)
+++ trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp 2019-03-12 19:02:22 UTC (rev 242810)
@@ -195,7 +195,6 @@
case GetByOffset:
case GetGetterSetterByOffset:
case GetEnumerableLength:
- case HasIndexedProperty:
case FiatInt52:
case BooleanToNumber:
case CheckBadCell:
@@ -282,6 +281,7 @@
case GetDynamicVar:
case GetMapBucket:
case HasGenericProperty:
+ case HasIndexedProperty:
case HasOwnProperty:
case HasStructureProperty:
case InById:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
