Title: [290517] trunk
- Revision
- 290517
- Author
- [email protected]
- Date
- 2022-02-25 11:03:10 -0800 (Fri, 25 Feb 2022)
Log Message
operationMaterializeObjectInOSR should DeferTerminationForAWhile instead of just DeferTermination.
https://bugs.webkit.org/show_bug.cgi?id=237173
rdar://problem/89450245
Reviewed by Yusuke Suzuki.
JSTests:
* stress/termination-exception-in-operationMaterializeObjectInOSR2.js: Added.
Source/_javascript_Core:
DeferTermination can throw the TerminationException on destruction of the scope
object. operationMaterializeObjectInOSR() was using DeferTermination, resulting
in the TerminationException being thrown on exit. This trips up
validateDFGExceptionHandling testing (which is enabled on Debug builds) because the
TerminationException is unexpected. The solution is simply to use
DeferTerminationForAWhile instead, and let a more natural trap checkpoint throw
the TerminationException later.
Also refactored notifyDebuggerOfUnwinding() to return early if a debugger is not
present. This avoids unnecessarily entering and exiting a DeferTermination scope
in notifyDebuggerOfUnwinding(). This was observed while testing this change on
the attached test case.
* ftl/FTLOperations.cpp:
(JSC::FTL::operationMaterializeObjectInOSR):
* interpreter/Interpreter.cpp:
(JSC::notifyDebuggerOfUnwinding):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (290516 => 290517)
--- trunk/JSTests/ChangeLog 2022-02-25 18:53:01 UTC (rev 290516)
+++ trunk/JSTests/ChangeLog 2022-02-25 19:03:10 UTC (rev 290517)
@@ -1,3 +1,13 @@
+2022-02-25 Mark Lam <[email protected]>
+
+ operationMaterializeObjectInOSR should DeferTerminationForAWhile instead of just DeferTermination.
+ https://bugs.webkit.org/show_bug.cgi?id=237173
+ rdar://problem/89450245
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/termination-exception-in-operationMaterializeObjectInOSR2.js: Added.
+
2022-02-24 Angelos Oikonomopoulos <[email protected]>
Skip shadow-realm-import-value on ARM too
Added: trunk/JSTests/stress/termination-exception-in-operationMaterializeObjectInOSR2.js (0 => 290517)
--- trunk/JSTests/stress/termination-exception-in-operationMaterializeObjectInOSR2.js (rev 0)
+++ trunk/JSTests/stress/termination-exception-in-operationMaterializeObjectInOSR2.js 2022-02-25 19:03:10 UTC (rev 290517)
@@ -0,0 +1,18 @@
+//@ skip if $buildType == "release"
+//@ runDefault("--watchdog=90", "--jitPolicyScale=0", "--watchdog-exception-ok")
+
+function bar() {
+ try {
+ undefined instanceof [];
+ } catch {}
+ let a = [0];
+ for (let i = 0; i < 100; i++) {}
+ foo();
+ let b = a;
+}
+
+function foo() {
+ bar();
+}
+
+bar();
Modified: trunk/Source/_javascript_Core/ChangeLog (290516 => 290517)
--- trunk/Source/_javascript_Core/ChangeLog 2022-02-25 18:53:01 UTC (rev 290516)
+++ trunk/Source/_javascript_Core/ChangeLog 2022-02-25 19:03:10 UTC (rev 290517)
@@ -1,3 +1,29 @@
+2022-02-25 Mark Lam <[email protected]>
+
+ operationMaterializeObjectInOSR should DeferTerminationForAWhile instead of just DeferTermination.
+ https://bugs.webkit.org/show_bug.cgi?id=237173
+ rdar://problem/89450245
+
+ Reviewed by Yusuke Suzuki.
+
+ DeferTermination can throw the TerminationException on destruction of the scope
+ object. operationMaterializeObjectInOSR() was using DeferTermination, resulting
+ in the TerminationException being thrown on exit. This trips up
+ validateDFGExceptionHandling testing (which is enabled on Debug builds) because the
+ TerminationException is unexpected. The solution is simply to use
+ DeferTerminationForAWhile instead, and let a more natural trap checkpoint throw
+ the TerminationException later.
+
+ Also refactored notifyDebuggerOfUnwinding() to return early if a debugger is not
+ present. This avoids unnecessarily entering and exiting a DeferTermination scope
+ in notifyDebuggerOfUnwinding(). This was observed while testing this change on
+ the attached test case.
+
+ * ftl/FTLOperations.cpp:
+ (JSC::FTL::operationMaterializeObjectInOSR):
+ * interpreter/Interpreter.cpp:
+ (JSC::notifyDebuggerOfUnwinding):
+
2022-02-24 Yusuke Suzuki <[email protected]>
[JSC] Use DeferTerminationForAWhile in Interpreter::unwind
Modified: trunk/Source/_javascript_Core/ftl/FTLOperations.cpp (290516 => 290517)
--- trunk/Source/_javascript_Core/ftl/FTLOperations.cpp 2022-02-25 18:53:01 UTC (rev 290516)
+++ trunk/Source/_javascript_Core/ftl/FTLOperations.cpp 2022-02-25 19:03:10 UTC (rev 290517)
@@ -192,7 +192,7 @@
// It's too hairy to handle TerminationExceptions during OSR object materialization.
// Let's just wait until after.
- DeferTermination deferTermination(vm);
+ DeferTerminationForAWhile deferTermination(vm);
// We cannot GC. We've got pointers in evil places.
DeferGCForAWhile deferGC(vm);
Modified: trunk/Source/_javascript_Core/interpreter/Interpreter.cpp (290516 => 290517)
--- trunk/Source/_javascript_Core/interpreter/Interpreter.cpp 2022-02-25 18:53:01 UTC (rev 290516)
+++ trunk/Source/_javascript_Core/interpreter/Interpreter.cpp 2022-02-25 19:03:10 UTC (rev 290517)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008-2021 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2022 Apple Inc. All rights reserved.
* Copyright (C) 2008 Cameron Zwarich <[email protected]>
*
* Redistribution and use in source and binary forms, with or without
@@ -503,18 +503,21 @@
ALWAYS_INLINE static void notifyDebuggerOfUnwinding(VM& vm, CallFrame* callFrame)
{
+ JSGlobalObject* globalObject = callFrame->lexicalGlobalObject(vm);
+ Debugger* debugger = globalObject->debugger();
+ if (LIKELY(!debugger))
+ return;
+
DeferTermination deferScope(vm);
- JSGlobalObject* globalObject = callFrame->lexicalGlobalObject(vm);
auto catchScope = DECLARE_CATCH_SCOPE(vm);
- if (Debugger* debugger = globalObject->debugger()) {
- SuspendExceptionScope scope(&vm);
- if (callFrame->isAnyWasmCallee()
- || (callFrame->callee().isCell() && callFrame->callee().asCell()->inherits<JSFunction>(vm)))
- debugger->unwindEvent(callFrame);
- else
- debugger->didExecuteProgram(callFrame);
- catchScope.assertNoException();
- }
+
+ SuspendExceptionScope scope(&vm);
+ if (callFrame->isAnyWasmCallee()
+ || (callFrame->callee().isCell() && callFrame->callee().asCell()->inherits<JSFunction>(vm)))
+ debugger->unwindEvent(callFrame);
+ else
+ debugger->didExecuteProgram(callFrame);
+ catchScope.assertNoException();
}
CatchInfo::CatchInfo(const HandlerInfo* handler, CodeBlock* codeBlock)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
