Bug 209035

Summary: DFG nodes that take a TypedArray's storage need to keepAlive the TypedArray
Product: WebKit Reporter: Keith Miller <keith_miller>
Component: New BugsAssignee: Keith Miller <keith_miller>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, ews-watchlist, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch for landing none

Keith Miller
Reported 2020-03-12 19:51:13 PDT
DFG nodes that take a TypedArray's storage need to keepalive the TypedArray
Attachments
Patch (2.82 KB, patch)
2020-03-12 19:57 PDT, Keith Miller 		no flags
DetailsFormatted DiffDiff
Patch for landing (2.82 KB, patch)
2020-03-12 20:28 PDT, Keith Miller 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Keith Miller
Comment 1 2020-03-12 19:57:19 PDT
Created attachment 393446 [details] Patch
Saam Barati
Comment 2 2020-03-12 19:59:51 PDT
Comment on attachment 393446 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review r=me > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843 > + keepAlive(lowJSValue(baseEdge)); seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do)
Keith Miller
Comment 3 2020-03-12 20:27:12 PDT
Comment on attachment 393446 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review >> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843 >> + keepAlive(lowJSValue(baseEdge)); > > seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do) Yeah, I think you're right. I copied this from the !storageEdge case above but we fix the edge in this case in fixup...
Keith Miller
Comment 4 2020-03-12 20:28:22 PDT
Created attachment 393447 [details] Patch for landing
WebKit Commit Bot
Comment 5 2020-03-12 21:16:41 PDT
Comment on attachment 393447 [details] Patch for landing Clearing flags on attachment: 393447 Committed r258381: <https://trac.webkit.org/changeset/258381>
WebKit Commit Bot
Comment 6 2020-03-12 21:16:43 PDT
All reviewed patches have been landed. Closing bug.
Radar WebKit Bug Importer
Comment 7 2020-03-12 21:17:17 PDT
<rdar://problem/60402343>
Note You need to log in before you can comment on or make changes to this bug.