Title: [245192] trunk/Source/_javascript_Core
- Revision
- 245192
- Author
- [email protected]
- Date
- 2019-05-10 13:37:07 -0700 (Fri, 10 May 2019)
Log Message
testb3 failing with crash in JSC::B3::BasicBlock::appendNonTerminal
https://bugs.webkit.org/show_bug.cgi?id=197756
<rdar://problem/50641659>
Reviewed by Saam Barati.
When I added https://bugs.webkit.org/show_bug.cgi?id=197265 I assumed that which block is the root does not change in the middle of strength reduction.
But specializeSelect can use splitForward, which uses a new block for the first half of the given block.
So if the block being split is the root block I must update m_root and erase the m_valueInConstant cache.
Erasing the cache cannot cause wrong results: at most it can make us miss some optimization opportunities in this iteration of the fixpoint.
* b3/B3ReduceStrength.cpp:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (245191 => 245192)
--- trunk/Source/_javascript_Core/ChangeLog 2019-05-10 20:30:05 UTC (rev 245191)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-05-10 20:37:07 UTC (rev 245192)
@@ -1,3 +1,18 @@
+2019-05-10 Robin Morisset <[email protected]>
+
+ testb3 failing with crash in JSC::B3::BasicBlock::appendNonTerminal
+ https://bugs.webkit.org/show_bug.cgi?id=197756
+ <rdar://problem/50641659>
+
+ Reviewed by Saam Barati.
+
+ When I added https://bugs.webkit.org/show_bug.cgi?id=197265 I assumed that which block is the root does not change in the middle of strength reduction.
+ But specializeSelect can use splitForward, which uses a new block for the first half of the given block.
+ So if the block being split is the root block I must update m_root and erase the m_valueInConstant cache.
+ Erasing the cache cannot cause wrong results: at most it can make us miss some optimization opportunities in this iteration of the fixpoint.
+
+ * b3/B3ReduceStrength.cpp:
+
2019-05-09 Keith Miller <[email protected]>
Fix crashes related to pointer authentication for primitive gigacage
Modified: trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp (245191 => 245192)
--- trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp 2019-05-10 20:30:05 UTC (rev 245191)
+++ trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp 2019-05-10 20:37:07 UTC (rev 245192)
@@ -2162,6 +2162,7 @@
m_valueForConstant.add(key, m_value);
else {
Value* constInRoot = m_proc.clone(m_value);
+ ASSERT(m_root && m_root->size() >= 1);
m_root->appendNonTerminal(constInRoot);
m_valueForConstant.add(key, constInRoot);
m_value->replaceWithIdentity(constInRoot);
@@ -2224,8 +2225,11 @@
// This mutates startIndex to account for the fact that m_block got the front of it
// chopped off.
- BasicBlock* predecessor =
- m_blockInsertionSet.splitForward(m_block, m_index, &m_insertionSet);
+ BasicBlock* predecessor = m_blockInsertionSet.splitForward(m_block, m_index, &m_insertionSet);
+ if (m_block == m_root) {
+ m_root = predecessor;
+ m_valueForConstant.clear();
+ }
// Splitting will commit the insertion set, which changes the exact position of the
// source. That's why we do the search after splitting.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
