Bug 209035 - DFG nodes that take a TypedArray's storage need to keepAlive the TypedArray
Summary: DFG nodes that take a TypedArray's storage need to keepAlive the TypedArray
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Keith Miller
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-03-12 19:51 PDT by Keith Miller
Modified: 2020-03-12 21:17 PDT (History)
7 users (show)

See Also:

Attachments
Patch (2.82 KB, patch)
2020-03-12 19:57 PDT, Keith Miller 		no flags Details | Formatted Diff | Diff
Patch for landing (2.82 KB, patch)
2020-03-12 20:28 PDT, Keith Miller 		no flags Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Keith Miller 2020-03-12 19:51:13 PDT 
DFG nodes that take a TypedArray's storage need to keepalive the TypedArray
Comment 1 Keith Miller 2020-03-12 19:57:19 PDT 
Created attachment 393446 [details]
Patch
Comment 2 Saam Barati 2020-03-12 19:59:51 PDT 
Comment on attachment 393446 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review

r=me

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843
> +        keepAlive(lowJSValue(baseEdge));

seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do)
Comment 3 Keith Miller 2020-03-12 20:27:12 PDT 
Comment on attachment 393446 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843
>> +        keepAlive(lowJSValue(baseEdge));
> 
> seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do)

Yeah, I think you're right. I copied this from the !storageEdge case above but we fix the edge in this case in fixup...
Comment 4 Keith Miller 2020-03-12 20:28:22 PDT 
Created attachment 393447 [details]
Patch for landing
Comment 5 WebKit Commit Bot 2020-03-12 21:16:41 PDT 
Comment on attachment 393447 [details]
Patch for landing

Clearing flags on attachment: 393447

Committed r258381: <https://trac.webkit.org/changeset/258381>
Comment 6 WebKit Commit Bot 2020-03-12 21:16:43 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 7 Radar WebKit Bug Importer 2020-03-12 21:17:17 PDT 
<rdar://problem/60402343>