CheckTraps, GetMapBucket, and Switch nodes can GC.
<rdar://problem/47889777>
Created attachment 361420 [details] proposed patch.
Comment on attachment 361420 [details] proposed patch. r=me
Thanks for the review. Landed in r241140: <http://trac.webkit.org/r241140>.
Note GCC doesn't like this: [1181/3497] Building CXX object Source...sources/UnifiedSource-bfc896e1-6.cpp.o In file included from DerivedSources/JavaScriptCore/unified-sources/UnifiedSource-bfc896e1-6.cpp:3: ../../Source/JavaScriptCore/dfg/DFGDoesGC.cpp: In function ‘bool JSC::DFG::doesGC(JSC::DFG::Graph&, JSC::DFG::Node*)’: ../../Source/JavaScriptCore/dfg/DFGDoesGC.cpp:464:9: warning: this statement may fall through [-Wimplicit-fallthrough=] switch (node->switchData()->kind) { ^~~~~~ ../../Source/JavaScriptCore/dfg/DFGDoesGC.cpp:479:5: note: here case LastNodeType: ^~~~ I'll also remove the two unreachable returns while I'm fixing this.
Committed r241314: <https://trac.webkit.org/changeset/241314>