GetIndexedPropertyStorage can GC.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Oct 2018 04:16:24 +0000 (04:16 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Oct 2018 04:16:24 +0000 (04:16 +0000)
commitac3ba37c21c50111846cd5875794d8a831d8f3f9
tree9cec9d1df11772534e44c275fceb0ab57fe35675
parent177e098c57aa8b490d1b0b98651d848edb115193
GetIndexedPropertyStorage can GC.
https://bugs.webkit.org/show_bug.cgi?id=190625
<rdar://problem/45309366>

Reviewed by Saam Barati.

This is because if the ArrayMode type is String, the DFG and FTL will be emitting
a call to operationResolveRope, and operationResolveRope can GC.  This patch
updates doesGC() to reflect this.

* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@237215 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGDoesGC.cpp