Bug 209397

Summary: [JSC] DeleteById / DeleteByVal in DFG / FTL should emit write-barrier inside this node when its child1 is speculated as UntypedUse
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: NEW    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo, ysuzuki
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch none

Yusuke Suzuki
Reported 2020-03-22 03:54:58 PDT
...
Attachments
Patch (20.38 KB, patch)
2020-03-23 18:43 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Patch (20.68 KB, patch)
2020-03-23 18:50 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2020-03-23 18:43:57 PDT
Created attachment 394337 [details] Patch
Yusuke Suzuki
Comment 2 2020-03-23 18:50:42 PDT
Created attachment 394338 [details] Patch
Note You need to log in before you can comment on or make changes to this bug.