Changeset 287621 in webkit

Timestamp:

Jan 5, 2022, 10:20:44 AM (5 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r285978. rdar://problem/87124911

[JSC] TypedArray GetArrayLength should not use Reuse
​https://bugs.webkit.org/show_bug.cgi?id=233299
rdar://85502079

Reviewed by Robin Morisset.

JSTests:

• stress/get-array-length-reuse.js: Added. (foo):

Source/JavaScriptCore:

We should not perform OSR exit after assigning a value to a reused register, otherwise,
OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
OSR exit after loading a length, so we should not use reused register for length.

• dfg/DFGSpeculativeJIT.cpp:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@285978 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/get-array-length-reuse.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

branches/safari-612-branch/JSTests/ChangeLog

@@ +1 @@
+2022-01-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r285978. rdar://problem/87124911
+
+    [JSC] TypedArray GetArrayLength should not use Reuse
+    https://bugs.webkit.org/show_bug.cgi?id=233299
+    rdar://85502079
+    
+    Reviewed by Robin Morisset.
+    
+    JSTests:
+    
+    * stress/get-array-length-reuse.js: Added.
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    We should not perform OSR exit after assigning a value to a reused register, otherwise,
+    OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
+    OSR exit after loading a length, so we should not use reused register for length.
+    
+    * dfg/DFGSpeculativeJIT.cpp:
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@285978 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-11-17  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] TypedArray GetArrayLength should not use Reuse
+            https://bugs.webkit.org/show_bug.cgi?id=233299
+            rdar://85502079
+
+            Reviewed by Robin Morisset.
+
+            * stress/get-array-length-reuse.js: Added.
+            (foo):
+
 2021-11-11  Alan Coon  <alancoon@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2022-01-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r285978. rdar://problem/87124911
+
+    [JSC] TypedArray GetArrayLength should not use Reuse
+    https://bugs.webkit.org/show_bug.cgi?id=233299
+    rdar://85502079
+    
+    Reviewed by Robin Morisset.
+    
+    JSTests:
+    
+    * stress/get-array-length-reuse.js: Added.
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    We should not perform OSR exit after assigning a value to a reused register, otherwise,
+    OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
+    OSR exit after loading a length, so we should not use reused register for length.
+    
+    * dfg/DFGSpeculativeJIT.cpp:
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@285978 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-11-17  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] TypedArray GetArrayLength should not use Reuse
+            https://bugs.webkit.org/show_bug.cgi?id=233299
+            rdar://85502079
+
+            Reviewed by Robin Morisset.
+
+            We should not perform OSR exit after assigning a value to a reused register, otherwise,
+            OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
+            OSR exit after loading a length, so we should not use reused register for length.
+
+            * dfg/DFGSpeculativeJIT.cpp:
+
 2021-11-11  Alan Coon  <alancoon@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -8359 +8359 @@
         ASSERT(node->arrayMode().isSomeTypedArrayView());
         SpeculateCellOperand base(this, node->child1());
-        GPRTemporary result(this, Reuse, base);
+        GPRTemporary result(this);
         GPRReg baseGPR = base.gpr();
         GPRReg resultGPR = result.gpr();