125425 2013-12-08 12:04:26 -0800 Fold storage pointer for GC-allocated typed arrays 2016-08-23 15:15:22 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All REOPENED P2 Normal --- 1 fpizlo fpizlo barraclough ggaren mark.lam mhahnenberg msaboff oliver sam oldest_to_newest 957687 0 fpizlo 2013-12-08 12:04:26 -0800 This probably won't be *too* profitable but I suspect that eventually it'll be needed. 1222389 1 fpizlo 2016-08-23 13:43:12 -0700 *** This bug has been marked as a duplicate of bug 161100 *** 1222452 2 fpizlo 2016-08-23 15:15:22 -0700 Nope, this is still a bug. Even if the GC-allocated typed array doesn't move, we still can't constant-fold pointers to it because of neutering: - To constant-fold, we need to install a watchpoint on the typed array's underlying buffer to make sure that we get notified if it gets neutered. - To install a watchpoint, we need to request the buffer. - To request the buffer, we need to move the backing store out of GC space. - To move it out of GC space, we need to malloc a new backing store and copy the data over and repoint m_vector. - Therefore, constant folding will fold to the *old* buffer. Ouch!