Changeset 242862 in webkit

Timestamp:

Mar 13, 2019, 1:24:57 AM (7 years ago)

Author:

bshafiei@apple.com

Message:

Cherry-pick r242810. rdar://problem/48839349

The HasIndexedProperty node does GC.
​https://bugs.webkit.org/show_bug.cgi?id=195559
<rdar://problem/48767923>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/HasIndexedProperty-does-gc.js: Added.

Source/JavaScriptCore:

HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
which can eventually call JSString::getIndex(), which can resolve a rope.

• dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242810 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/HasIndexedProperty-does-gc.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGDoesGC.cpp (modified) (2 diffs)

branches/safari-607-branch/JSTests/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242810. rdar://problem/48839349
+
+    The HasIndexedProperty node does GC.
+    https://bugs.webkit.org/show_bug.cgi?id=195559
+    <rdar://problem/48767923>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/HasIndexedProperty-does-gc.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+    which can eventually call JSString::getIndex(), which can resolve a rope.
+    
+    * dfg/DFGDoesGC.cpp:
+    (JSC::DFG::doesGC):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242810 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-12  Mark Lam  <mark.lam@apple.com>
+
+            The HasIndexedProperty node does GC.
+            https://bugs.webkit.org/show_bug.cgi?id=195559
+            <rdar://problem/48767923>
+
+            Reviewed by Yusuke Suzuki.
+
+            * stress/HasIndexedProperty-does-gc.js: Added.
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242810. rdar://problem/48839349
+
+    The HasIndexedProperty node does GC.
+    https://bugs.webkit.org/show_bug.cgi?id=195559
+    <rdar://problem/48767923>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/HasIndexedProperty-does-gc.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+    which can eventually call JSString::getIndex(), which can resolve a rope.
+    
+    * dfg/DFGDoesGC.cpp:
+    (JSC::DFG::doesGC):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242810 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-12  Mark Lam  <mark.lam@apple.com>
+
+            The HasIndexedProperty node does GC.
+            https://bugs.webkit.org/show_bug.cgi?id=195559
+            <rdar://problem/48767923>
+
+            Reviewed by Yusuke Suzuki.
+
+            HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
+            which can eventually call JSString::getIndex(), which can resolve a rope.
+
+            * dfg/DFGDoesGC.cpp:
+            (JSC::DFG::doesGC):
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

@@ -202 +202 @@
     case GetGetterSetterByOffset:
     case GetEnumerableLength:
-    case HasIndexedProperty:
     case FiatInt52:
     case BooleanToNumber:
@@ -289 +288 @@
     case GetMapBucket:
     case HasGenericProperty:
+    case HasIndexedProperty:
     case HasOwnProperty:
     case HasStructureProperty: