Title: [255297] branches/safari-610.1.1-branch/Source/_javascript_Core
- Revision
- 255297
- Author
- [email protected]
- Date
- 2020-01-28 13:49:41 -0800 (Tue, 28 Jan 2020)
Log Message
Cherry-pick r254996. rdar://problem/58535628
OptimizeAssociativeExpressionTrees should reset value owners before running
https://bugs.webkit.org/show_bug.cgi?id=206670
<rdar://problem/58535628>
Reviewed by Robin Morisset.
We have a crash inside OptimizeAssociativeExpressionTrees and we don't know
how to reproduce it. Also, based on Mark's auditing of the crash site's
assembly, Mark thinks we're crashing on a "currupt" basic block.
After I audited the code, I saw that we rely on value owners in this phase.
However, we don't actually reset them before running the phase. This patch
adds that as a speculative fix for the crash we're seeing.
* b3/B3OptimizeAssociativeExpressionTrees.cpp:
(JSC::B3::OptimizeAssociativeExpressionTrees::run):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254996 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-610.1.1-branch/Source/_javascript_Core/ChangeLog (255296 => 255297)
--- branches/safari-610.1.1-branch/Source/_javascript_Core/ChangeLog 2020-01-28 21:49:39 UTC (rev 255296)
+++ branches/safari-610.1.1-branch/Source/_javascript_Core/ChangeLog 2020-01-28 21:49:41 UTC (rev 255297)
@@ -1,5 +1,48 @@
2020-01-28 Russell Epstein <[email protected]>
+ Cherry-pick r254996. rdar://problem/58535628
+
+ OptimizeAssociativeExpressionTrees should reset value owners before running
+ https://bugs.webkit.org/show_bug.cgi?id=206670
+ <rdar://problem/58535628>
+
+ Reviewed by Robin Morisset.
+
+ We have a crash inside OptimizeAssociativeExpressionTrees and we don't know
+ how to reproduce it. Also, based on Mark's auditing of the crash site's
+ assembly, Mark thinks we're crashing on a "currupt" basic block.
+
+ After I audited the code, I saw that we rely on value owners in this phase.
+ However, we don't actually reset them before running the phase. This patch
+ adds that as a speculative fix for the crash we're seeing.
+
+ * b3/B3OptimizeAssociativeExpressionTrees.cpp:
+ (JSC::B3::OptimizeAssociativeExpressionTrees::run):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254996 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-01-23 Saam Barati <[email protected]>
+
+ OptimizeAssociativeExpressionTrees should reset value owners before running
+ https://bugs.webkit.org/show_bug.cgi?id=206670
+ <rdar://problem/58535628>
+
+ Reviewed by Robin Morisset.
+
+ We have a crash inside OptimizeAssociativeExpressionTrees and we don't know
+ how to reproduce it. Also, based on Mark's auditing of the crash site's
+ assembly, Mark thinks we're crashing on a "currupt" basic block.
+
+ After I audited the code, I saw that we rely on value owners in this phase.
+ However, we don't actually reset them before running the phase. This patch
+ adds that as a speculative fix for the crash we're seeing.
+
+ * b3/B3OptimizeAssociativeExpressionTrees.cpp:
+ (JSC::B3::OptimizeAssociativeExpressionTrees::run):
+
+2020-01-28 Russell Epstein <[email protected]>
+
Cherry-pick r254962. rdar://problem/58811967
Restore nullification of DFG::Plan::m_vm when the plan is cancelled.
Modified: branches/safari-610.1.1-branch/Source/_javascript_Core/b3/B3OptimizeAssociativeExpressionTrees.cpp (255296 => 255297)
--- branches/safari-610.1.1-branch/Source/_javascript_Core/b3/B3OptimizeAssociativeExpressionTrees.cpp 2020-01-28 21:49:39 UTC (rev 255296)
+++ branches/safari-610.1.1-branch/Source/_javascript_Core/b3/B3OptimizeAssociativeExpressionTrees.cpp 2020-01-28 21:49:41 UTC (rev 255297)
@@ -249,6 +249,8 @@
// In the second one we optimize each such _expression_ tree in turn.
// We need the use counts to avoid duplicating code.
+ m_proc.resetValueOwners();
+
Vector<unsigned> useCounts(m_proc.values().size(), 0); // Mapping from Value::m_index to use counts.
HashSet<Value*> expressionTreeRoots;
HashSet<BasicBlock*> rootOwners;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
