Bug 180057 - Spread can escape when CreateRest does not
Summary: Spread can escape when CreateRest does not
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-11-27 14:57 PST by Saam Barati
Modified: 2017-11-27 16:14 PST (History)
12 users (show)

See Also:


Attachments
patch (11.47 KB, patch)
2017-11-27 15:09 PST, Saam Barati
jfbastien: review+
Details | Formatted Diff | Diff
patch for landing (11.49 KB, patch)
2017-11-27 15:41 PST, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2017-11-27 14:57:50 PST
Previously, we didn't handle this IR because I didn't think it was possible to generate. It turns out it is possible, and it happens when we PutStack the Spread but nothing escapes the CreateRest. It's easy to support this, so we will. Patch forthcoming.
Comment 1 Saam Barati 2017-11-27 15:08:34 PST
<rdar://problem/35676119>
Comment 2 Saam Barati 2017-11-27 15:09:12 PST
Created attachment 327692 [details]
patch
Comment 3 JF Bastien 2017-11-27 15:31:20 PST
Comment on attachment 327692 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=327692&action=review

r=me

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5292
> +            static_assert(sizeof(JSValue) == 8 && 1 << 3 == 8, "Assumed in the code below.");

1 << 3 == 8 ? Seems pretty stable :p
Comment 4 Saam Barati 2017-11-27 15:41:48 PST
Created attachment 327701 [details]
patch for landing
Comment 5 WebKit Commit Bot 2017-11-27 16:14:11 PST
Comment on attachment 327701 [details]
patch for landing

Clearing flags on attachment: 327701

Committed r225202: <https://trac.webkit.org/changeset/225202>
Comment 6 WebKit Commit Bot 2017-11-27 16:14:12 PST
All reviewed patches have been landed.  Closing bug.