| Summary: | Replace IC on Proxy must write barrier Proxy's target | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Saam Barati <saam> | ||||||
| Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | ews-watchlist, keith_miller, mark.lam, msaboff, tzagallo, webkit-bug-importer, ysuzuki | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Attachments: |
|
||||||||
|
Description
Saam Barati
2020-08-20 17:35:43 PDT
Created attachment 406986 [details]
patch
I'm going to keep trying to write a test, but I've spent an hour on it with no success.
Comment on attachment 406986 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=406986&action=review Nice, r=me > Source/JavaScriptCore/bytecode/AccessCase.cpp:1798 > + jit.loadPtr(CCallHelpers::Address(baseGPR, JSProxy::targetOffset()), scratchGPR); > + auto spillState = state.preserveLiveRegistersToStackForCallWithoutExceptions(); > + jit.setupArguments<decltype(operationWriteBarrierSlowPath)>(CCallHelpers::TrustedImmPtr(&vm), scratchGPR); > + jit.prepareCallOperation(vm); > + auto operationCall = jit.call(OperationPtrTag); > + jit.addLinkTask([=] (LinkBuffer& linkBuffer) { > + linkBuffer.link(operationCall, FunctionPtr<OperationPtrTag>(operationWriteBarrierSlowPath)); > + }); > + state.restoreLiveRegistersFromStackForCall(spillState); > + Can you check whether AccessCase::doesCalls change is necessary? Created attachment 406996 [details]
patch for landing
Committed r265997: <https://trac.webkit.org/changeset/265997> All reviewed patches have been landed. Closing bug and clearing flags on attachment 406996 [details]. |