[webkit-reviews] review granted: [Bug 195234] [JSC] Store bits for JSRopeString in 3 stores : [Attachment 363418] Patch

[bugzilla-daemon at webkit.org]

Saam Barati <sbarati at apple.com> has granted Yusuke Suzuki <ysuzuki at apple.com>'s
request for review:
Bug 195234: [JSC] Store bits for JSRopeString in 3 stores
https://bugs.webkit.org/show_bug.cgi?id=195234

Attachment 363418: Patch

https://bugs.webkit.org/attachment.cgi?id=363418&action=review




--- Comment #6 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 363418
  --> https://bugs.webkit.org/attachment.cgi?id=363418
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=363418&action=review

r=me

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6537
> +	   // This puts nullptr for the first fiber. It makes visitChildren
safe even if this JSRopeString is discarded due to the speculation failure in
the following path.
> +	   m_out.storePtr(m_out.constIntPtr(JSString::isRopeInPointer), result,
m_heaps.JSRopeString_fiber0);

This is somewhat scary, please make sure we have tests.