Changeset 285978 in webkit

Timestamp:

Nov 17, 2021, 9:01:47 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] TypedArray GetArrayLength should not use Reuse
​https://bugs.webkit.org/show_bug.cgi?id=233299
rdar://85502079

Reviewed by Robin Morisset.

JSTests:

• stress/get-array-length-reuse.js: Added.

(foo):

Source/JavaScriptCore:

We should not perform OSR exit after assigning a value to a reused register, otherwise,
OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
OSR exit after loading a length, so we should not use reused register for length.

• dfg/DFGSpeculativeJIT.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/get-array-length-reuse.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-11-17  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] TypedArray GetArrayLength should not use Reuse
+        https://bugs.webkit.org/show_bug.cgi?id=233299
+        rdar://85502079
+
+        Reviewed by Robin Morisset.
+
+        * stress/get-array-length-reuse.js: Added.
+        (foo):
+
 2021-11-17  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-11-17  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] TypedArray GetArrayLength should not use Reuse
+        https://bugs.webkit.org/show_bug.cgi?id=233299
+        rdar://85502079
+
+        Reviewed by Robin Morisset.
+
+        We should not perform OSR exit after assigning a value to a reused register, otherwise,
+        OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
+        OSR exit after loading a length, so we should not use reused register for length.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+
 2021-11-17  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -8662 +8662 @@
         ASSERT(node->arrayMode().isSomeTypedArrayView());
         SpeculateCellOperand base(this, node->child1());
-        GPRTemporary result(this, Reuse, base);
+        GPRTemporary result(this);
         GPRReg baseGPR = base.gpr();
         GPRReg resultGPR = result.gpr();