Changeset 271489 in webkit

Timestamp:

Jan 14, 2021, 10:10:38 AM (6 years ago)

Author:

sbarati@apple.com

Message:

Baseline JIT should emit mutatorFence after inline allocations
​https://bugs.webkit.org/show_bug.cgi?id=220572

Reviewed by Yusuke Suzuki.

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_new_object):
(JSC::JIT::emit_op_create_this):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITOpcodes.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-01-14  Saam Barati  <sbarati@apple.com>
+
+        Baseline JIT should emit mutatorFence after inline allocations
+        https://bugs.webkit.org/show_bug.cgi?id=220572
+
+        Reviewed by Yusuke Suzuki.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+
 2021-01-13  Xan Lopez  <xan@igalia.com>
 

trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

@@ -102 +102 @@
         emitAllocateJSObject(resultReg, JITAllocator::constant(allocator), allocatorReg, TrustedImmPtr(structure), butterfly, scratchReg, slowCases);
         emitInitializeInlineStorage(resultReg, structure->inlineCapacity());
+        mutatorFence(*m_vm);
         addSlowCase(slowCases);
         emitPutVirtualRegister(bytecode.m_dst);
@@ -1086 +1087 @@
     load8(Address(structureReg, Structure::inlineCapacityOffset()), scratchReg);
     emitInitializeInlineStorage(resultReg, scratchReg);
+    mutatorFence(*m_vm);
     addSlowCase(slowCases);
     emitPutVirtualRegister(bytecode.m_dst);