Title: [104086] trunk
Revision
104086
Author
[email protected]
Date
2012-01-04 15:13:30 -0800 (Wed, 04 Jan 2012)

Log Message

Incorrect use of DFG node reference counts when mutating the graph
https://bugs.webkit.org/show_bug.cgi?id=75580
<rdar://problem/10644607>

Source/_javascript_Core: 

Reviewed by Oliver Hunt.
        
Made deref(node) follow the pattern of ref(node), which it should have
to begin with.

* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::refChildren):
(JSC::DFG::Graph::derefChildren):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::deref):
(JSC::DFG::Graph::clearAndDerefChild1):
(JSC::DFG::Graph::clearAndDerefChild2):
(JSC::DFG::Graph::clearAndDerefChild3):
* dfg/DFGNode.h:
(JSC::DFG::Node::deref):
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::fixupNode):

LayoutTests: 

Reviewed by Oliver Hunt.

* fast/js/dfg-array-length-dead-expected.txt: Added.
* fast/js/dfg-array-length-dead.html: Added.
* fast/js/script-tests/dfg-array-length-dead.js: Added.
(foo):

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (104085 => 104086)


--- trunk/LayoutTests/ChangeLog	2012-01-04 23:11:54 UTC (rev 104085)
+++ trunk/LayoutTests/ChangeLog	2012-01-04 23:13:30 UTC (rev 104086)
@@ -1,3 +1,16 @@
+2012-01-04  Filip Pizlo  <[email protected]>
+
+        Incorrect use of DFG node reference counts when mutating the graph
+        https://bugs.webkit.org/show_bug.cgi?id=75580
+        <rdar://problem/10644607>
+
+        Reviewed by Oliver Hunt.
+
+        * fast/js/dfg-array-length-dead-expected.txt: Added.
+        * fast/js/dfg-array-length-dead.html: Added.
+        * fast/js/script-tests/dfg-array-length-dead.js: Added.
+        (foo):
+
 2012-01-03  Ryosuke Niwa  <[email protected]>
 
         REGRESSION (r92823): Background color not preserved when copying and pasting a table row

Added: trunk/LayoutTests/fast/js/dfg-array-length-dead-expected.txt (0 => 104086)


--- trunk/LayoutTests/fast/js/dfg-array-length-dead-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-array-length-dead-expected.txt	2012-01-04 23:13:30 UTC (rev 104086)
@@ -0,0 +1,1009 @@
+Tests that an array length access being dead does not result in register allocation failures.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS foo({f:[]}) is 42
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/fast/js/dfg-array-length-dead.html (0 => 104086)


--- trunk/LayoutTests/fast/js/dfg-array-length-dead.html	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-array-length-dead.html	2012-01-04 23:13:30 UTC (rev 104086)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/fast/js/script-tests/dfg-array-length-dead.js (0 => 104086)


--- trunk/LayoutTests/fast/js/script-tests/dfg-array-length-dead.js	                        (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-array-length-dead.js	2012-01-04 23:13:30 UTC (rev 104086)
@@ -0,0 +1,13 @@
+description(
+"Tests that an array length access being dead does not result in register allocation failures."
+);
+
+function foo(x) {
+    var y = x.f.length;
+    return 42;
+}
+
+for (var i = 0; i < 1000; ++i) {
+    shouldBe("foo({f:[]})", "42");
+}
+

Modified: trunk/Source/_javascript_Core/ChangeLog (104085 => 104086)


--- trunk/Source/_javascript_Core/ChangeLog	2012-01-04 23:11:54 UTC (rev 104085)
+++ trunk/Source/_javascript_Core/ChangeLog	2012-01-04 23:13:30 UTC (rev 104086)
@@ -1,3 +1,27 @@
+2012-01-04  Filip Pizlo  <[email protected]>
+
+        Incorrect use of DFG node reference counts when mutating the graph
+        https://bugs.webkit.org/show_bug.cgi?id=75580
+        <rdar://problem/10644607>
+
+        Reviewed by Oliver Hunt.
+        
+        Made deref(node) follow the pattern of ref(node), which it should have
+        to begin with.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::refChildren):
+        (JSC::DFG::Graph::derefChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::deref):
+        (JSC::DFG::Graph::clearAndDerefChild1):
+        (JSC::DFG::Graph::clearAndDerefChild2):
+        (JSC::DFG::Graph::clearAndDerefChild3):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::deref):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixupNode):
+
 2012-01-04  Tor Arne Vestbø  <[email protected]>
 
         [Qt] Introduce new qmake variable 'WEBKIT' for signaling dependencies

Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.cpp (104085 => 104086)


--- trunk/Source/_javascript_Core/dfg/DFGGraph.cpp	2012-01-04 23:11:54 UTC (rev 104085)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.cpp	2012-01-04 23:13:30 UTC (rev 104086)
@@ -300,31 +300,42 @@
 
 #endif
 
-// FIXME: Convert this method to be iterative, not recursive.
+// FIXME: Convert this to be iterative, not recursive.
+#define DO_TO_CHILDREN(node, thingToDo) do {                            \
+        Node& _node = (node);                                           \
+        if (_node.op & NodeHasVarArgs) {                                \
+            for (unsigned _childIdx = _node.firstChild();               \
+                 _childIdx < _node.firstChild() + _node.numChildren();  \
+                 _childIdx++)                                           \
+                thingToDo(m_varArgChildren[_childIdx]);                 \
+        } else {                                                        \
+            if (_node.child1() == NoNode) {                             \
+                ASSERT(_node.child2() == NoNode                         \
+                       && _node.child3() == NoNode);                    \
+                return;                                                 \
+            }                                                           \
+            thingToDo(_node.child1());                                  \
+                                                                        \
+            if (_node.child2() == NoNode) {                             \
+                ASSERT(_node.child3() == NoNode);                       \
+                return;                                                 \
+            }                                                           \
+            thingToDo(_node.child2());                                  \
+                                                                        \
+            if (_node.child3() == NoNode)                               \
+                return;                                                 \
+            thingToDo(_node.child3());                                  \
+        }                                                               \
+    } while (false)
+
 void Graph::refChildren(NodeIndex op)
 {
-    Node& node = at(op);
+    DO_TO_CHILDREN(at(op), ref);
+}
 
-    if (node.op & NodeHasVarArgs) {
-        for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
-            ref(m_varArgChildren[childIdx]);
-    } else {
-        if (node.child1() == NoNode) {
-            ASSERT(node.child2() == NoNode && node.child3() == NoNode);
-            return;
-        }
-        ref(node.child1());
-
-        if (node.child2() == NoNode) {
-            ASSERT(node.child3() == NoNode);
-            return;
-        }
-        ref(node.child2());
-
-        if (node.child3() == NoNode)
-            return;
-        ref(node.child3());
-    }
+void Graph::derefChildren(NodeIndex op)
+{
+    DO_TO_CHILDREN(at(op), deref);
 }
 
 void Graph::predictArgumentTypes(CodeBlock* codeBlock)

Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.h (104085 => 104086)


--- trunk/Source/_javascript_Core/dfg/DFGGraph.h	2012-01-04 23:11:54 UTC (rev 104085)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.h	2012-01-04 23:13:30 UTC (rev 104086)
@@ -80,11 +80,17 @@
             refChildren(nodeIndex);
     }
     
+    void deref(NodeIndex nodeIndex)
+    {
+        if (at(nodeIndex).deref())
+            derefChildren(nodeIndex);
+    }
+    
     void clearAndDerefChild1(Node& node)
     {
         if (node.children.fixed.child1 == NoNode)
             return;
-        at(node.children.fixed.child1).deref();
+        deref(node.children.fixed.child1);
         node.children.fixed.child1 = NoNode;
     }
 
@@ -92,7 +98,7 @@
     {
         if (node.children.fixed.child2 == NoNode)
             return;
-        at(node.children.fixed.child2).deref();
+        deref(node.children.fixed.child2);
         node.children.fixed.child2 = NoNode;
     }
 
@@ -100,7 +106,7 @@
     {
         if (node.children.fixed.child3 == NoNode)
             return;
-        at(node.children.fixed.child3).deref();
+        deref(node.children.fixed.child3);
         node.children.fixed.child3 = NoNode;
     }
 
@@ -259,6 +265,7 @@
     
     // When a node's refCount goes from 0 to 1, it must (logically) recursively ref all of its children, and vice versa.
     void refChildren(NodeIndex);
+    void derefChildren(NodeIndex);
 
     PredictionTracker m_predictions;
 };

Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (104085 => 104086)


--- trunk/Source/_javascript_Core/dfg/DFGNode.h	2012-01-04 23:11:54 UTC (rev 104085)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h	2012-01-04 23:13:30 UTC (rev 104086)
@@ -836,9 +836,13 @@
         m_refCount = refCount;
     }
     
-    void deref()
+    // Derefs the node and returns true if the ref count reached zero.
+    // In general you don't want to use this directly; use Graph::deref
+    // instead.
+    bool deref()
     {
-        m_refCount--;
+        ASSERT(m_refCount);
+        return !--m_refCount;
     }
     
     NodeIndex child1()

Modified: trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp (104085 => 104086)


--- trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp	2012-01-04 23:11:54 UTC (rev 104085)
+++ trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp	2012-01-04 23:13:30 UTC (rev 104086)
@@ -928,7 +928,7 @@
                 node.op = GetFloat64ArrayLength;
             else
                 ASSERT_NOT_REACHED();
-            node.deref(); // No longer MustGenerate
+            m_graph.deref(m_compileIndex); // No longer MustGenerate
             break;
         }
         case GetIndexedPropertyStorage: {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to