Summary: | [JSC] Implement JSMapIterator/JSSetIterator with JSInternalFieldObjectImpl | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Yusuke Suzuki <ysuzuki> | ||||||||||||||||
Component: | New Bugs | Assignee: | Yusuke Suzuki <ysuzuki> | ||||||||||||||||
Status: | RESOLVED FIXED | ||||||||||||||||||
Severity: | Normal | CC: | alecflett, beidson, ews-watchlist, hi, joepeck, jsbell, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer | ||||||||||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||||||||||
Version: | WebKit Nightly Build | ||||||||||||||||||
Hardware: | Unspecified | ||||||||||||||||||
OS: | Unspecified | ||||||||||||||||||
Bug Depends on: | |||||||||||||||||||
Bug Blocks: | 175454 | ||||||||||||||||||
Attachments: |
|
Description
Yusuke Suzuki
2020-04-05 04:58:16 PDT
Created attachment 395500 [details]
Patch
Created attachment 395501 [details]
Patch
Created attachment 395503 [details]
Patch
Created attachment 395546 [details]
Patch
Created attachment 395548 [details]
Patch
Created attachment 395552 [details]
Patch
Created attachment 395553 [details]
Patch
Comment on attachment 395553 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395553&action=review r=me. > Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:3225 > + // Add the constant before exit becomes invalid because we may want to insert (redundant) checks on it in Fixup. > + Node* kindNode = jsConstant(jsNumber(static_cast<uint32_t>(kind))); Why does exit become invalid here? Seems like nothing here has effects should prevent an exit? > Source/JavaScriptCore/ftl/FTLOperations.cpp:131 > + target->internalField(static_cast<typename JSCellType::Field>(property.location().info())).set(vm, target, JSValue::decode(values[i])); Maybe add an ASSERT(property.location().info() < typename JSCellType::numberOfInternalFields);? Comment on attachment 395553 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395553&action=review >> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:3225 >> + Node* kindNode = jsConstant(jsNumber(static_cast<uint32_t>(kind))); > > Why does exit become invalid here? Seems like nothing here has effects should prevent an exit? Ah, right. Removed the comment. >> Source/JavaScriptCore/ftl/FTLOperations.cpp:131 >> + target->internalField(static_cast<typename JSCellType::Field>(property.location().info())).set(vm, target, JSValue::decode(values[i])); > > Maybe add an ASSERT(property.location().info() < typename JSCellType::numberOfInternalFields);? Sounds nice! Committed r260181: <https://trac.webkit.org/changeset/260181> Committed r260226: <https://trac.webkit.org/changeset/260226> |