Summary: | Fix CellTag being set 32 bits even if the base is not a cell | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Mikhail R. Gadelha <mikhail> | ||||||||
Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer, ysuzuki | ||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||
Version: | WebKit Nightly Build | ||||||||||
Hardware: | Unspecified | ||||||||||
OS: | Unspecified | ||||||||||
Attachments: |
|
Description
Mikhail R. Gadelha
2021-09-16 11:28:06 PDT
Created attachment 438375 [details]
Patch
Created attachment 438404 [details]
Patch
Comment on attachment 438404 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=438404&action=review Commented. > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:13711 > + JSValueRegs baseRegs; > + if (isCell(baseEdge.useKind())) { > + SpeculateCellOperand base(this, baseEdge); > + baseRegs = JSValueRegs::payloadOnly(base.gpr()); > + } else { > + JSValueOperand base(this, baseEdge); > + baseRegs = base.regs(); > + } This is not correct. When SpeculateCellOperand / JSValueOperand are destroyed, its tied register is unlocked. Created attachment 438498 [details]
Patch
Comment on attachment 438498 [details]
Patch
r=me
Committed r282722 (241859@main): <https://commits.webkit.org/241859@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 438498 [details]. |