tree d570a2c7711966e1a8c4cf857f9bf886cc3ee478
parent 9835eef20e173101c3fa5bd5374bfd45463458f8
author mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571702667 +0000
committer mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571702667 +0000

Fix issues when setting public length on ArrayWithContiguous type butterflies.
https://bugs.webkit.org/show_bug.cgi?id=203211
<rdar://problem/56476097>

Reviewed by Keith Miller and Saam Barati.

For ArrayWithContiguous type butterflies, SlotVisitor scans up to the public
length of the butterfly.  When setting a new public length, if the new public
length is greater than the current, we should always writeBarrier after the
setting of the new public length.  Otherwise, there can be a race where the GC
scans the butterfly after new values have been written to it but before the
public length as been updated.  As a result, the new values never get scanned.

For the DFG and FTL, the StoreBarrierInsertionPhase is responsible for inserting
the writeBarriers after the node.  Hence, the writeBarrier is guaranteed to be
after the publicLength has been updated.

* runtime/JSArray.cpp:
(JSC::JSArray::shiftCountWithArrayStorage):
(JSC::JSArray::shiftCountWithAnyIndexingType):
* runtime/JSArrayInlines.h:
(JSC::JSArray::pushInline):
* runtime/JSObject.cpp:
(JSC::JSObject::putByIndex):
(JSC::JSObject::reallocateAndShrinkButterfly):
* runtime/JSObject.h:
(JSC::JSObject::setIndexQuickly):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251399 268f45cc-cd09-0410-ab3c-d52691b4dbfc