Changeset 259572 in webkit

Timestamp:

Apr 6, 2020 8:41:48 AM (4 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Put ensureStillAliveHere for Integer TypedArrays in GetByVal
​https://bugs.webkit.org/show_bug.cgi?id=210047

Reviewed by Mark Lam.

While r258381 puts ensureStillAliveHere in FTL to keep base alive for float/double TypedArrays,
we need to do the same thing for integer TypedArrays too. This patch places it.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-06  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Put ensureStillAliveHere for Integer TypedArrays in GetByVal
+        https://bugs.webkit.org/show_bug.cgi?id=210047
+
+        Reviewed by Mark Lam.
+
+        While r258381 puts ensureStillAliveHere in FTL to keep base alive for float/double TypedArrays,
+        we need to do the same thing for integer TypedArrays too. This patch places it.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
+
 2020-04-05  Gus Caplan  <me@gus.host> and Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -4707 +4707 @@
                 if (isInt(type)) {
                     LValue result = loadFromIntTypedArray(pointer, type);
+                    // We have to keep base alive since that keeps storage alive.
+                    ensureStillAliveHere(base);
                     bool canSpeculate = true;
                     setIntTypedArrayLoadResult(result, type, canSpeculate);