[webkit-reviews] review granted: [Bug 195234] [JSC] Store bits for JSRopeString in 3 stores : [Attachment 363418] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Mar 4 11:57:50 PST 2019

Saam Barati <sbarati at apple.com> has granted Yusuke Suzuki <ysuzuki at apple.com>'s
request for review:
Bug 195234: [JSC] Store bits for JSRopeString in 3 stores

Attachment 363418: Patch


--- Comment #6 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 363418
  --> https://bugs.webkit.org/attachment.cgi?id=363418

View in context: https://bugs.webkit.org/attachment.cgi?id=363418&action=review


> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6537
> +	   // This puts nullptr for the first fiber. It makes visitChildren
safe even if this JSRopeString is discarded due to the speculation failure in
the following path.
> +	   m_out.storePtr(m_out.constIntPtr(JSString::isRopeInPointer), result,

This is somewhat scary, please make sure we have tests.

More information about the webkit-reviews mailing list