Bug 193483 – StringObjectUse should not be a structure check for the original string object structure

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

This is probably buggy, and goes against how we use UseKinds elsewhere. We should figure out the handful of places that actually rely on this behavior and have them emit a CheckStructure. And then change StringObjectUse to just mean that the thing has StringObject classInfo.

[Saam Barati]

<rdar://problem/47280522>

[Saam Barati]

Created attachment 359354 [details]
patch

[Yusuke Suzuki]

Comment on attachment 359354 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=359354&action=review

r=me with FTL fixes

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6335
> +            LValue type = m_out.load32(cell, m_heaps.JSCell_typeInfoType);

load8ZeroExt32?

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:16068
> +        LValue type = m_out.load32(cellBase, m_heaps.JSCell_typeInfoType);

Ditto.

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:16088
> +        LValue type = m_out.load32(cell, m_heaps.JSCell_typeInfoType);

Ditto.

[Saam Barati]

Comment on attachment 359354 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=359354&action=review

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6335
>> +            LValue type = m_out.load32(cell, m_heaps.JSCell_typeInfoType);
> 
> load8ZeroExt32?

Oops. Will fix

[Saam Barati]

Created attachment 359359 [details]
patch for landing

[WebKit Commit Bot]

Comment on attachment 359359 [details]
patch for landing

Clearing flags on attachment: 359359

Committed r240114: <https://trac.webkit.org/changeset/240114>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Michael Catanzaro]

Committed r240225: <https://trac.webkit.org/changeset/240225>