Bug 215720 – Replace IC on Proxy must write barrier Proxy's target

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

...

[Saam Barati]

Created attachment 406986 [details]
patch

I'm going to keep trying to write a test, but I've spent an hour on it with no success.

[Yusuke Suzuki]

Comment on attachment 406986 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=406986&action=review

Nice, r=me

> Source/JavaScriptCore/bytecode/AccessCase.cpp:1798
> +            jit.loadPtr(CCallHelpers::Address(baseGPR, JSProxy::targetOffset()), scratchGPR);
> +            auto spillState = state.preserveLiveRegistersToStackForCallWithoutExceptions();
> +            jit.setupArguments<decltype(operationWriteBarrierSlowPath)>(CCallHelpers::TrustedImmPtr(&vm), scratchGPR);
> +            jit.prepareCallOperation(vm);
> +            auto operationCall = jit.call(OperationPtrTag);
> +            jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
> +                linkBuffer.link(operationCall, FunctionPtr<OperationPtrTag>(operationWriteBarrierSlowPath));
> +            });
> +            state.restoreLiveRegistersFromStackForCall(spillState);
> +

Can you check whether AccessCase::doesCalls change is necessary?

[Saam Barati]

Created attachment 406996 [details]
patch for landing

[EWS]

Committed r265997: <https://trac.webkit.org/changeset/265997>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 406996 [details].

[Radar WebKit Bug Importer]

<rdar://problem/67527868>