Branch: refs/heads/main Home: https://github.com/WebKit/WebKit Commit: 1b4792d4d3661bcde4d66b7be0d02f9b0d506392 https://github.com/WebKit/WebKit/commit/1b4792d4d3661bcde4d66b7be0d02f9b0d506392 Author: Yusuke Suzuki <ysuz...@apple.com> Date: 2022-10-12 (Wed, 12 Oct 2022)
Changed paths: A JSTests/stress/slow-put-array-empty-push.js M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp Log Message: ----------- [JSC] Use storage node in ArrayPush for SlowPutArray https://bugs.webkit.org/show_bug.cgi?id=246405 rdar://problem/101081844 Reviewed by Justin Michaud. This patch fixes a bug that GetArrayLength gets nullptr crash when we convert ArrayPush+SlowPutArray with empty arguments to GetArrayLength because we are discarding butterfly storage for that case. But since SlowPutArray's ArrayPush is slow anyway, let's simplify our code and always get butterfly storage even for SlowPutArray case. * JSTests/stress/slow-put-array-empty-push.js: Added. (runNearStackLimit): (__f_6): (__f_32): * Source/JavaScriptCore/dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp: * Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush): Canonical link: https://commits.webkit.org/255454@main _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes