Baseline JIT's in_by_val and emitHasPrivate should load the property before branching on if the base is a cell

[Saam Barati]

Just for our own sanity when reasoning about what the slow paths do, we don't want a random value in property when the base isn't a cell.

[Saam Barati]

Created attachment 436926 [details]
patch

[Yusuke Suzuki]

Comment on attachment 436926 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=436926&action=review

r=me too

> Source/JavaScriptCore/jit/JITPropertyAccess.cpp:1519
>      emitArrayProfilingSiteWithCell(regT0, profile, regT2);

Can you also ensure that AccessCase IC code for InByVal / InById reserves the above registers if we go to the slow path?

[Saam Barati]

(In reply to Yusuke Suzuki from comment #2)
> Comment on attachment 436926 [details]
> patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=436926&action=review
> 
> r=me too
> 
> > Source/JavaScriptCore/jit/JITPropertyAccess.cpp:1519
> >      emitArrayProfilingSiteWithCell(regT0, profile, regT2);
> 
> Can you also ensure that AccessCase IC code for InByVal / InById reserves
> the above registers if we go to the slow path?

Confirmed that they do not clobber these registers.

[EWS]

Committed r281826 (241160@main): <https://commits.webkit.org/241160@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 436926 [details].

[Radar WebKit Bug Importer]

<rdar://problem/82600217>