Title: [204901] trunk
- Revision
- 204901
- Author
- [email protected]
- Date
- 2016-08-24 09:55:50 -0700 (Wed, 24 Aug 2016)
Log Message
js/regress/put-by-id-transition-with-indexing-header.html and svg/carto.net/window.svg fail in debug after r204854
https://bugs.webkit.org/show_bug.cgi?id=161115
Reviewed by Keith Miller.
Source/_javascript_Core:
There were two small goofs.
* bytecode/ObjectAllocationProfile.h:
(JSC::ObjectAllocationProfile::isNull): The new policy is that the allocator can be null. So now the way you tell if the profile is null is by checking the structure.
* jit/JITOperations.cpp: This was using DeferGC, which is now definitely wrong. It forces the GC to happen when the structure and butterfly are mismatched. It's better for the GC to happen before we put the butterfly in the object.
LayoutTests:
* TestExpectations:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (204900 => 204901)
--- trunk/LayoutTests/ChangeLog 2016-08-24 16:47:11 UTC (rev 204900)
+++ trunk/LayoutTests/ChangeLog 2016-08-24 16:55:50 UTC (rev 204901)
@@ -1,3 +1,12 @@
+2016-08-23 Filip Pizlo <[email protected]>
+
+ js/regress/put-by-id-transition-with-indexing-header.html and svg/carto.net/window.svg fail in debug after r204854
+ https://bugs.webkit.org/show_bug.cgi?id=161115
+
+ Reviewed by Keith Miller.
+
+ * TestExpectations:
+
2016-08-24 Mark Lam <[email protected]>
Gardening: restoring 2 test expectations removed in r204870 by mistake.
Modified: trunk/LayoutTests/TestExpectations (204900 => 204901)
--- trunk/LayoutTests/TestExpectations 2016-08-24 16:47:11 UTC (rev 204900)
+++ trunk/LayoutTests/TestExpectations 2016-08-24 16:55:50 UTC (rev 204901)
@@ -1237,5 +1237,3 @@
webkit.org/b/159755 fast/text/emoji-gender.html [ ImageOnlyFailure ]
webkit.org/b/160017 js/regress-139548.html [ Slow ]
-
-[Debug] webkit.org/b/161114 svg/carto.net/window.svg [ Skip ]
Modified: trunk/Source/_javascript_Core/ChangeLog (204900 => 204901)
--- trunk/Source/_javascript_Core/ChangeLog 2016-08-24 16:47:11 UTC (rev 204900)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-08-24 16:55:50 UTC (rev 204901)
@@ -1,3 +1,16 @@
+2016-08-23 Filip Pizlo <[email protected]>
+
+ js/regress/put-by-id-transition-with-indexing-header.html and svg/carto.net/window.svg fail in debug after r204854
+ https://bugs.webkit.org/show_bug.cgi?id=161115
+
+ Reviewed by Keith Miller.
+
+ There were two small goofs.
+
+ * bytecode/ObjectAllocationProfile.h:
+ (JSC::ObjectAllocationProfile::isNull): The new policy is that the allocator can be null. So now the way you tell if the profile is null is by checking the structure.
+ * jit/JITOperations.cpp: This was using DeferGC, which is now definitely wrong. It forces the GC to happen when the structure and butterfly are mismatched. It's better for the GC to happen before we put the butterfly in the object.
+
2016-08-24 Filip Pizlo <[email protected]>
AssemblyHelpers::emitAllocateWithNonNullAllocator() crashes in the FTL on ARM64
Modified: trunk/Source/_javascript_Core/bytecode/ObjectAllocationProfile.h (204900 => 204901)
--- trunk/Source/_javascript_Core/bytecode/ObjectAllocationProfile.h 2016-08-24 16:47:11 UTC (rev 204900)
+++ trunk/Source/_javascript_Core/bytecode/ObjectAllocationProfile.h 2016-08-24 16:55:50 UTC (rev 204901)
@@ -45,7 +45,7 @@
{
}
- bool isNull() { return !m_allocator; }
+ bool isNull() { return !m_structure; }
void initialize(VM& vm, JSCell* owner, JSObject* prototype, unsigned inferredInlineCapacity)
{
Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (204900 => 204901)
--- trunk/Source/_javascript_Core/jit/JITOperations.cpp 2016-08-24 16:47:11 UTC (rev 204900)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp 2016-08-24 16:55:50 UTC (rev 204901)
@@ -2119,7 +2119,6 @@
NativeCallFrameTracer tracer(&vm, exec);
ASSERT(!object->structure()->outOfLineCapacity());
- DeferGC deferGC(vm.heap);
Butterfly* result = object->growOutOfLineStorage(vm, 0, initialOutOfLineCapacity);
object->setButterflyWithoutChangingStructure(vm, result);
return reinterpret_cast<char*>(result);
@@ -2130,7 +2129,6 @@
VM& vm = exec->vm();
NativeCallFrameTracer tracer(&vm, exec);
- DeferGC deferGC(vm.heap);
Butterfly* result = object->growOutOfLineStorage(vm, object->structure()->outOfLineCapacity(), newSize);
object->setButterflyWithoutChangingStructure(vm, result);
return reinterpret_cast<char*>(result);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
