Bug 230364 – Fix CellTag being set 32 bits even if the base is not a cell

• Component: New Bugs
• Status: RESOLVED FIXED

[Mikhail R. Gadelha]

Fix CellTag being set 32 bits even if the base is not a cell

[Mikhail R. Gadelha]

Created attachment 438375 [details]
Patch

[Mikhail R. Gadelha]

Created attachment 438404 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 438404 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=438404&action=review

Commented.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:13711
> +    JSValueRegs baseRegs;
> +    if (isCell(baseEdge.useKind())) {
> +        SpeculateCellOperand base(this, baseEdge);
> +        baseRegs = JSValueRegs::payloadOnly(base.gpr());
> +    } else {
> +        JSValueOperand base(this, baseEdge);
> +        baseRegs = base.regs();
> +    }

This is not correct. When SpeculateCellOperand / JSValueOperand are destroyed, its tied register is unlocked.

[Mikhail R. Gadelha]

Created attachment 438498 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 438498 [details]
Patch

r=me

[EWS]

Committed r282722 (241859@main): <https://commits.webkit.org/241859@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 438498 [details].

[Radar WebKit Bug Importer]

<rdar://problem/83267081>