Title: [225188] trunk/Source/_javascript_Core
- Revision
- 225188
- Author
- [email protected]
- Date
- 2017-11-27 12:40:51 -0800 (Mon, 27 Nov 2017)
Log Message
Having a bad time watchpoint firing during compilation revealed a racy assertion
https://bugs.webkit.org/show_bug.cgi?id=180048
<rdar://problem/35700009>
Reviewed by Mark Lam.
While a DFG compilation is watching the having a bad time watchpoint, it was
asserting that the rest parameter structure has indexing type ArrayWithContiguous.
However, if the having a bad time watchpoint fires during the compilation,
this particular structure will no longer have ArrayWithContiguous indexing type.
This patch fixes this racy assertion to be aware that the watchpoint may fire
during compilation.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCreateRest):
(JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (225187 => 225188)
--- trunk/Source/_javascript_Core/ChangeLog 2017-11-27 20:39:18 UTC (rev 225187)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-11-27 20:40:51 UTC (rev 225188)
@@ -1,3 +1,22 @@
+2017-11-27 Saam Barati <[email protected]>
+
+ Having a bad time watchpoint firing during compilation revealed a racy assertion
+ https://bugs.webkit.org/show_bug.cgi?id=180048
+ <rdar://problem/35700009>
+
+ Reviewed by Mark Lam.
+
+ While a DFG compilation is watching the having a bad time watchpoint, it was
+ asserting that the rest parameter structure has indexing type ArrayWithContiguous.
+ However, if the having a bad time watchpoint fires during the compilation,
+ this particular structure will no longer have ArrayWithContiguous indexing type.
+ This patch fixes this racy assertion to be aware that the watchpoint may fire
+ during compilation.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileCreateRest):
+ (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
+
2017-11-27 Tim Horton <[email protected]>
One too many zeroes in macOS version number in FeatureDefines
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (225187 => 225188)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-11-27 20:39:18 UTC (rev 225187)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-11-27 20:40:51 UTC (rev 225188)
@@ -7246,7 +7246,7 @@
GPRReg arrayResultGPR = arrayResult.gpr();
bool shouldAllowForArrayStorageStructureForLargeArrays = false;
- ASSERT(m_jit.graph().globalObjectFor(node->origin.semantic)->restParameterStructure()->indexingType() == ArrayWithContiguous);
+ ASSERT(m_jit.graph().globalObjectFor(node->origin.semantic)->restParameterStructure()->indexingType() == ArrayWithContiguous || m_jit.graph().globalObjectFor(node->origin.semantic)->isHavingABadTime());
compileAllocateNewArrayWithSize(m_jit.graph().globalObjectFor(node->origin.semantic), arrayResultGPR, arrayLengthGPR, ArrayWithContiguous, shouldAllowForArrayStorageStructureForLargeArrays);
GPRTemporary argumentsStart(this);
@@ -7446,7 +7446,7 @@
bool shouldAllowForArrayStorageStructureForLargeArrays = false;
- ASSERT(m_jit.graph().globalObjectFor(node->origin.semantic)->restParameterStructure()->indexingType() == ArrayWithContiguous);
+ ASSERT(m_jit.graph().globalObjectFor(node->origin.semantic)->restParameterStructure()->indexingType() == ArrayWithContiguous || m_jit.graph().globalObjectFor(node->origin.semantic)->isHavingABadTime());
compileAllocateNewArrayWithSize(m_jit.graph().globalObjectFor(node->origin.semantic), resultGPR, lengthGPR, ArrayWithContiguous, shouldAllowForArrayStorageStructureForLargeArrays);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
