RESOLVED FIXED 193920
ToString node actually does GC. 
https://bugs.webkit.org/show_bug.cgi?id=193920
Summary ToString node actually does GC.
Mark Lam
Reported 2019-01-28 12:47:06 PST
Currently, ToString is incorrectly modeled as not GC'ing in DFG doesGC(). <rdar://problem/46695900>
Attachments
proposed patch. (6.21 KB, patch)
2019-01-28 15:14 PST, Mark Lam 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2019-01-28 13:19:56 PST
(In reply to Mark Lam from comment #0) > Currently, ToString is incorrectly modeled as not GC'ing in DFG doesGC(). > > <rdar://problem/46695900> What does clobberize say?
Mark Lam
Comment 2 2019-01-28 13:30:30 PST
(In reply to Saam Barati from comment #1) > (In reply to Mark Lam from comment #0) > > Currently, ToString is incorrectly modeled as not GC'ing in DFG doesGC(). > > > > <rdar://problem/46695900> > > What does clobberize say? Cloberrize says: def(PureValue(node)); ... which defers to doesGC(), which says false. So, it's wrong.
Mark Lam
Comment 3 2019-01-28 15:14:14 PST
Created attachment 360383 [details] proposed patch.
Yusuke Suzuki
Comment 4 2019-01-28 15:26:55 PST
Comment on attachment 360383 [details] proposed patch. r=me
Mark Lam
Comment 5 2019-01-28 16:14:43 PST
Thanks for the review. Landing now.
WebKit Commit Bot
Comment 6 2019-01-28 16:41:50 PST
Comment on attachment 360383 [details] proposed patch. Clearing flags on attachment: 360383 Committed r240616: <https://trac.webkit.org/changeset/240616>
WebKit Commit Bot
Comment 7 2019-01-28 16:41:52 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.