Bug 233571 - [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
Summary: [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-11-29 10:05 PST by Yusuke Suzuki
Modified: 2021-11-29 11:10 PST (History)
7 users (show)

See Also:


Attachments
Patch (7.18 KB, patch)
2021-11-29 10:07 PST, Yusuke Suzuki
mark.lam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yusuke Suzuki 2021-11-29 10:05:00 PST
[JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
Comment 1 Yusuke Suzuki 2021-11-29 10:07:09 PST
Created attachment 445291 [details]
Patch
Comment 2 Yusuke Suzuki 2021-11-29 10:07:14 PST
<rdar://problem/85812164>
Comment 3 Mark Lam 2021-11-29 10:25:43 PST
Comment on attachment 445291 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=445291&action=review

r=me

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5110
> +        // If arrayMode is ForceExit, we do not compile it.

I suggest rephrasing this as "If arrayMode is ForceExit, we would not compile this node and hence, should not have arrived here."
Comment 4 Yusuke Suzuki 2021-11-29 11:09:52 PST
Comment on attachment 445291 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=445291&action=review

Thanks!

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5110
>> +        // If arrayMode is ForceExit, we do not compile it.
> 
> I suggest rephrasing this as "If arrayMode is ForceExit, we would not compile this node and hence, should not have arrived here."

Sounds good. Changed.
Comment 5 Yusuke Suzuki 2021-11-29 11:10:32 PST
Committed r286228 (244609@main): <https://commits.webkit.org/244609@main>