Bug 209035 – DFG nodes that take a TypedArray's storage need to keepAlive the TypedArray

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Keith Miller]

DFG nodes that take a TypedArray's storage need to keepalive the TypedArray

[Keith Miller]

Created attachment 393446 [details]
Patch

[Saam Barati]

Comment on attachment 393446 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review

r=me

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843
> +        keepAlive(lowJSValue(baseEdge));

seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do)

[Keith Miller]

Comment on attachment 393446 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843
>> +        keepAlive(lowJSValue(baseEdge));
> 
> seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do)

Yeah, I think you're right. I copied this from the !storageEdge case above but we fix the edge in this case in fixup...

[Keith Miller]

Created attachment 393447 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 393447 [details]
Patch for landing

Clearing flags on attachment: 393447

Committed r258381: <https://trac.webkit.org/changeset/258381>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/60402343>