Currently, ToString is incorrectly modeled as not GC'ing in DFG doesGC(). <rdar://problem/46695900>
(In reply to Mark Lam from comment #0) > Currently, ToString is incorrectly modeled as not GC'ing in DFG doesGC(). > > <rdar://problem/46695900> What does clobberize say?
(In reply to Saam Barati from comment #1) > (In reply to Mark Lam from comment #0) > > Currently, ToString is incorrectly modeled as not GC'ing in DFG doesGC(). > > > > <rdar://problem/46695900> > > What does clobberize say? Cloberrize says: def(PureValue(node)); ... which defers to doesGC(), which says false. So, it's wrong.
Created attachment 360383 [details] proposed patch.
Comment on attachment 360383 [details] proposed patch. r=me
Thanks for the review. Landing now.
Comment on attachment 360383 [details] proposed patch. Clearing flags on attachment: 360383 Committed r240616: <https://trac.webkit.org/changeset/240616>
All reviewed patches have been landed. Closing bug.