Title: [208299] trunk/Source/_javascript_Core
- Revision
- 208299
- Author
- [email protected]
- Date
- 2016-11-02 14:09:35 -0700 (Wed, 02 Nov 2016)
Log Message
Crash beneath SlotVisitor::drain @ cooksillustrated.com
https://bugs.webkit.org/show_bug.cgi?id=164304
Reviewed by Mark Lam.
Added back write barrier for the base cell of put-by_id in the LLInt when the structure is
changed. Also removed the unused macro "storeStructureWithTypeInfo".
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (208298 => 208299)
--- trunk/Source/_javascript_Core/ChangeLog 2016-11-02 20:38:23 UTC (rev 208298)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-11-02 21:09:35 UTC (rev 208299)
@@ -1,3 +1,16 @@
+2016-11-02 Michael Saboff <[email protected]>
+
+ Crash beneath SlotVisitor::drain @ cooksillustrated.com
+ https://bugs.webkit.org/show_bug.cgi?id=164304
+
+ Reviewed by Mark Lam.
+
+ Added back write barrier for the base cell of put-by_id in the LLInt when the structure is
+ changed. Also removed the unused macro "storeStructureWithTypeInfo".
+
+ * llint/LowLevelInterpreter32_64.asm:
+ * llint/LowLevelInterpreter64.asm:
+
2016-11-02 Keith Miller <[email protected]>
We should not pop from an empty stack in the Wasm function parser.
Modified: trunk/Source/_javascript_Core/llint/LowLevelInterpreter32_64.asm (208298 => 208299)
--- trunk/Source/_javascript_Core/llint/LowLevelInterpreter32_64.asm 2016-11-02 20:38:23 UTC (rev 208298)
+++ trunk/Source/_javascript_Core/llint/LowLevelInterpreter32_64.asm 2016-11-02 21:09:35 UTC (rev 208299)
@@ -490,13 +490,6 @@
payload)
end
-macro storeStructureWithTypeInfo(cell, structure, scratch)
- storep structure, JSCell::m_structureID[cell]
-
- loadi Structure::m_blob + StructureIDBlob::u.words.word2[structure], scratch
- storei scratch, JSCell::m_indexingType[cell]
-end
-
macro writeBarrierOnOperand(cellOperand)
loadisFromInstruction(cellOperand, t1)
loadConstantOrVariablePayload(t1, CellTag, t2, .writeBarrierDone)
@@ -1528,6 +1521,12 @@
.opPutByIdTransitionDirect:
storei t1, JSCell::m_structureID[t0]
+ loadi 12[PC], t1
+ loadConstantOrVariable(t1, t2, t3)
+ loadi 20[PC], t1
+ storePropertyAtVariableOffset(t1, t0, t2, t3)
+ writeBarrierOnOperand(1)
+ dispatch(9)
.opPutByIdNotTransition:
# The only thing live right now is t0, which holds the base.
Modified: trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm (208298 => 208299)
--- trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm 2016-11-02 20:38:23 UTC (rev 208298)
+++ trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm 2016-11-02 21:09:35 UTC (rev 208299)
@@ -486,11 +486,6 @@
loadp [cell, structure, 8], structure
end
-macro storeStructureWithTypeInfo(cell, structure, scratch)
- loadq Structure::m_blob + StructureIDBlob::u.doubleWord[structure], scratch
- storeq scratch, JSCell::m_structureID[cell]
-end
-
# Entrypoints into the interpreter.
# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
@@ -1409,6 +1404,10 @@
.opPutByIdTransitionDirect:
storei t1, JSCell::m_structureID[t0]
+ writeBarrierOnOperand(1)
+ # Reload base into t0
+ loadisFromInstruction(1, t1)
+ loadConstantOrVariable(t1, t0)
.opPutByIdNotTransition:
# The only thing live right now is t0, which holds the base.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
