Title: [98398] trunk/Source/_javascript_Core
- Revision
- 98398
- Author
- [email protected]
- Date
- 2011-10-25 14:56:31 -0700 (Tue, 25 Oct 2011)
Log Message
Tiered compilation may introduce dangling pointers in constant buffers
https://bugs.webkit.org/show_bug.cgi?id=70854
Reviewed by Oliver Hunt.
Tiered compilation now copies constant buffers, which fixes the regression in
https://bugs.webkit.org/show_bug.cgi?id=70246. No new tests because this
regression relies on a subtle interleaving of optimized compilation and garbage
collection, and cannot be reproduced in a simple test.
This also adds some new debug support, which was used to fix this bug and is
likely to be useful in the future.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::copyDataFrom):
(JSC::CodeBlock::usesOpcode):
* bytecode/CodeBlock.h:
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (98397 => 98398)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-25 21:44:05 UTC (rev 98397)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-25 21:56:31 UTC (rev 98398)
@@ -1,3 +1,25 @@
+2011-10-25 Filip Pizlo <[email protected]>
+
+ Tiered compilation may introduce dangling pointers in constant buffers
+ https://bugs.webkit.org/show_bug.cgi?id=70854
+
+ Reviewed by Oliver Hunt.
+
+ Tiered compilation now copies constant buffers, which fixes the regression in
+ https://bugs.webkit.org/show_bug.cgi?id=70246. No new tests because this
+ regression relies on a subtle interleaving of optimized compilation and garbage
+ collection, and cannot be reproduced in a simple test.
+
+ This also adds some new debug support, which was used to fix this bug and is
+ likely to be useful in the future.
+
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::copyDataFrom):
+ (JSC::CodeBlock::usesOpcode):
+ * bytecode/CodeBlock.h:
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::dump):
+
2011-10-25 Mark Hahnenberg <[email protected]>
Fixing Windows build after r98367
Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp (98397 => 98398)
--- trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2011-10-25 21:44:05 UTC (rev 98397)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2011-10-25 21:56:31 UTC (rev 98398)
@@ -1828,6 +1828,8 @@
replaceExistingEntries(m_constantRegisters, alternative->m_constantRegisters);
replaceExistingEntries(m_functionDecls, alternative->m_functionDecls);
replaceExistingEntries(m_functionExprs, alternative->m_functionExprs);
+ if (!!m_rareData && !!alternative->m_rareData)
+ replaceExistingEntries(m_rareData->m_constantBuffers, alternative->m_rareData->m_constantBuffers);
}
void CodeBlock::copyDataFromAlternative()
@@ -2002,4 +2004,31 @@
}
#endif
+#ifndef NDEBUG
+bool CodeBlock::usesOpcode(OpcodeID opcodeID)
+{
+ Interpreter* interpreter = globalData()->interpreter;
+ Instruction* instructionsBegin = instructions().begin();
+ unsigned instructionCount = instructions().size();
+
+ for (unsigned bytecodeOffset = 0; bytecodeOffset < instructionCount; ) {
+ switch (interpreter->getOpcodeID(instructionsBegin[bytecodeOffset].u.opcode)) {
+#define DEFINE_OP(curOpcode, length) \
+ case curOpcode: \
+ if (curOpcode == opcodeID) \
+ return true; \
+ bytecodeOffset += length; \
+ break;
+ FOR_EACH_OPCODE_ID(DEFINE_OP)
+#undef DEFINE_OP
+ default:
+ ASSERT_NOT_REACHED();
+ break;
+ }
+ }
+
+ return false;
+}
+#endif
+
} // namespace JSC
Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.h (98397 => 98398)
--- trunk/Source/_javascript_Core/bytecode/CodeBlock.h 2011-10-25 21:44:05 UTC (rev 98397)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.h 2011-10-25 21:56:31 UTC (rev 98398)
@@ -390,6 +390,10 @@
Vector<Instruction>& instructions() { return m_instructions; }
void discardBytecode() { m_instructions.clear(); }
+#ifndef NDEBUG
+ bool usesOpcode(OpcodeID);
+#endif
+
unsigned instructionCount() { return m_instructionCount; }
void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.cpp (98397 => 98398)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2011-10-25 21:44:05 UTC (rev 98397)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2011-10-25 21:56:31 UTC (rev 98398)
@@ -222,6 +222,18 @@
printf("%sr%u(%s)", hasPrinted ? ", " : "", operand, nameOfVariableAccessData(variableAccessData));
hasPrinted = true;
}
+ if (node.hasConstantBuffer() && codeBlock) {
+ if (hasPrinted)
+ printf(", ");
+ printf("%u:[", node.startConstant());
+ for (unsigned i = 0; i < node.numConstants(); ++i) {
+ if (i)
+ printf(", ");
+ printf("%s", codeBlock->constantBuffer(node.startConstant())[i].description());
+ }
+ printf("]");
+ hasPrinted = true;
+ }
if (op == JSConstant) {
printf("%s$%u", hasPrinted ? ", " : "", node.constantNumber());
if (codeBlock) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
