Changeset 240917 in webkit

Timestamp:

Feb 4, 2019, 12:15:46 AM (6 years ago)

Author:

mark.lam@apple.com

Message:

DFG's doesGC() is incorrect about the SameValue node's behavior.
​https://bugs.webkit.org/show_bug.cgi?id=194211
<rdar://problem/47608913>

Reviewed by Saam Barati.

Only the DoubleRepUse case is guaranteed to not GC. The other case may GC because
it calls operationSameValue() which may allocate memory for resolving ropes.

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGDoesGC.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-02-04  Mark Lam  <mark.lam@apple.com>
+
+        DFG's doesGC() is incorrect about the SameValue node's behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=194211
+        <rdar://problem/47608913>
+
+        Reviewed by Saam Barati.
+
+        Only the DoubleRepUse case is guaranteed to not GC.  The other case may GC because
+        it calls operationSameValue() which may allocate memory for resolving ropes.
+
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+
 2019-02-03  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

@@ -156 +156 @@
     case CompareStrictEq:
     case CompareEqPtr:
-    case SameValue:
     case Call:
     case DirectCall:
@@ -414 +413 @@
         return node->multiPutByOffsetData().reallocatesStorage();
 
+    case SameValue:
+        if (node->isBinaryUseKind(DoubleRepUse))
+            return false;
+        return true;
+
     case LastNodeType:
         RELEASE_ASSERT_NOT_REACHED();