| Summary: | DFG nodes that take a TypedArray's storage need to keepAlive the TypedArray | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Keith Miller <keith_miller> | ||||||
| Component: | New Bugs | Assignee: | Keith Miller <keith_miller> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | commit-queue, ews-watchlist, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Attachments: |
|
||||||||
|
Description
Keith Miller
2020-03-12 19:51:13 PDT
Created attachment 393446 [details]
Patch
Comment on attachment 393446 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review r=me > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843 > + keepAlive(lowJSValue(baseEdge)); seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do) Comment on attachment 393446 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=393446&action=review >> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:3843 >> + keepAlive(lowJSValue(baseEdge)); > > seems like this would crash in validation failure if we're speculating on base edge? Maybe pass ManualOperandSpeculation? (I don't remember if we actually speculate on base, but I presume we do) Yeah, I think you're right. I copied this from the !storageEdge case above but we fix the edge in this case in fixup... Created attachment 393447 [details]
Patch for landing
Comment on attachment 393447 [details] Patch for landing Clearing flags on attachment: 393447 Committed r258381: <https://trac.webkit.org/changeset/258381> All reviewed patches have been landed. Closing bug. |