Title: [234855] trunk/Source/_javascript_Core
- Revision
- 234855
- Author
- [email protected]
- Date
- 2018-08-14 10:46:35 -0700 (Tue, 14 Aug 2018)
Log Message
[JSC] GetByIdStatus::m_wasSeenInJIT is touched in GetByIdStatus::slowVersion
https://bugs.webkit.org/show_bug.cgi?id=188560
Reviewed by Keith Miller.
While GetByIdStatus() / GetByIdStatus(status) constructors do not set m_wasSeenInJIT,
it is loaded unconditionally in GetByIdStatus::slowVersion. This access to the
uninitialized member field is caught in UBSan. This patch fixes it by adding an initializer
`m_wasSeenInJIT { false }`.
* bytecode/GetByIdStatus.h:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (234854 => 234855)
--- trunk/Source/_javascript_Core/ChangeLog 2018-08-14 17:45:09 UTC (rev 234854)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-08-14 17:46:35 UTC (rev 234855)
@@ -1,5 +1,19 @@
2018-08-14 Yusuke Suzuki <[email protected]>
+ [JSC] GetByIdStatus::m_wasSeenInJIT is touched in GetByIdStatus::slowVersion
+ https://bugs.webkit.org/show_bug.cgi?id=188560
+
+ Reviewed by Keith Miller.
+
+ While GetByIdStatus() / GetByIdStatus(status) constructors do not set m_wasSeenInJIT,
+ it is loaded unconditionally in GetByIdStatus::slowVersion. This access to the
+ uninitialized member field is caught in UBSan. This patch fixes it by adding an initializer
+ `m_wasSeenInJIT { false }`.
+
+ * bytecode/GetByIdStatus.h:
+
+2018-08-14 Yusuke Suzuki <[email protected]>
+
[DFG] DFGPredictionPropagation should set PrimaryPass when processing invariants
https://bugs.webkit.org/show_bug.cgi?id=188557
Modified: trunk/Source/_javascript_Core/bytecode/GetByIdStatus.h (234854 => 234855)
--- trunk/Source/_javascript_Core/bytecode/GetByIdStatus.h 2018-08-14 17:45:09 UTC (rev 234854)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdStatus.h 2018-08-14 17:46:35 UTC (rev 234855)
@@ -158,7 +158,7 @@
State m_state;
Vector<GetByIdVariant, 1> m_variants;
- bool m_wasSeenInJIT;
+ bool m_wasSeenInJIT { false };
JSModuleNamespaceObject* m_moduleNamespaceObject { nullptr };
JSModuleEnvironment* m_moduleEnvironment { nullptr };
ScopeOffset m_scopeOffset { };
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
