Title: [271489] trunk/Source/_javascript_Core
Revision
271489
Author
sbar...@apple.com
Date
2021-01-14 10:10:38 -0800 (Thu, 14 Jan 2021)

Log Message

Baseline JIT should emit mutatorFence after inline allocations
https://bugs.webkit.org/show_bug.cgi?id=220572

Reviewed by Yusuke Suzuki.

* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emit_op_create_this):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (271488 => 271489)


--- trunk/Source/_javascript_Core/ChangeLog	2021-01-14 17:19:00 UTC (rev 271488)
+++ trunk/Source/_javascript_Core/ChangeLog	2021-01-14 18:10:38 UTC (rev 271489)
@@ -1,3 +1,14 @@
+2021-01-14  Saam Barati  <sbar...@apple.com>
+
+        Baseline JIT should emit mutatorFence after inline allocations
+        https://bugs.webkit.org/show_bug.cgi?id=220572
+
+        Reviewed by Yusuke Suzuki.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+
 2021-01-13  Xan Lopez  <x...@igalia.com>
 
         [JSC] Remove the unused compilation byproducts from the wasm embedder entrypoint

Modified: trunk/Source/_javascript_Core/jit/JITOpcodes.cpp (271488 => 271489)


--- trunk/Source/_javascript_Core/jit/JITOpcodes.cpp	2021-01-14 17:19:00 UTC (rev 271488)
+++ trunk/Source/_javascript_Core/jit/JITOpcodes.cpp	2021-01-14 18:10:38 UTC (rev 271489)
@@ -101,6 +101,7 @@
         auto butterfly = TrustedImmPtr(nullptr);
         emitAllocateJSObject(resultReg, JITAllocator::constant(allocator), allocatorReg, TrustedImmPtr(structure), butterfly, scratchReg, slowCases);
         emitInitializeInlineStorage(resultReg, structure->inlineCapacity());
+        mutatorFence(*m_vm);
         addSlowCase(slowCases);
         emitPutVirtualRegister(bytecode.m_dst);
     }
@@ -1085,6 +1086,7 @@
     emitAllocateJSObject(resultReg, JITAllocator::variable(), allocatorReg, structureReg, butterfly, scratchReg, slowCases);
     load8(Address(structureReg, Structure::inlineCapacityOffset()), scratchReg);
     emitInitializeInlineStorage(resultReg, scratchReg);
+    mutatorFence(*m_vm);
     addSlowCase(slowCases);
     emitPutVirtualRegister(bytecode.m_dst);
 }
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to