The HasIndexedProperty node does GC.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 12 Mar 2019 19:02:22 +0000 (19:02 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 12 Mar 2019 19:02:22 +0000 (19:02 +0000)
commitc3d415e22f25037a09371cb780fc043c8e30dc01
treedd5de6ef69f99b646e00e2e3b1a69b4076c20db2
parentd82f821e25326623b9c6722dafc4c54909a39fc3
The HasIndexedProperty node does GC.
https://bugs.webkit.org/show_bug.cgi?id=195559
<rdar://problem/48767923>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/HasIndexedProperty-does-gc.js: Added.

Source/JavaScriptCore:

HasIndexedProperty can call the slow path operationHasIndexedPropertyByInt(),
which can eventually call JSString::getIndex(), which can resolve a rope.

* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242810 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/HasIndexedProperty-does-gc.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGDoesGC.cpp