Modified: trunk/Source/_javascript_Core/ChangeLog (120147 => 120148)
--- trunk/Source/_javascript_Core/ChangeLog 2012-06-13 01:28:33 UTC (rev 120147)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-06-13 01:29:07 UTC (rev 120148)
@@ -1,3 +1,19 @@
+2012-06-12 Filip Pizlo <[email protected]>
+
+ REGRESSION(120121): inspector tests crash in DFG
+ https://bugs.webkit.org/show_bug.cgi?id=88941
+
+ Reviewed by Geoffrey Garen.
+
+ The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've
+ already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't
+ is that the second way depends on the node referring to other nodes in the to-be-jettisoned
+ block. After fixup they potentially will refer to nodes in the block being merged to.
+
+ * dfg/DFGCFGSimplificationPhase.cpp:
+ (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+ (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
2012-06-12 Leo Yang <[email protected]>
Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
Modified: trunk/Source/_javascript_Core/dfg/DFGCFGSimplificationPhase.cpp (120147 => 120148)
--- trunk/Source/_javascript_Core/dfg/DFGCFGSimplificationPhase.cpp 2012-06-13 01:28:33 UTC (rev 120147)
+++ trunk/Source/_javascript_Core/dfg/DFGCFGSimplificationPhase.cpp 2012-06-13 01:29:07 UTC (rev 120148)
@@ -288,7 +288,7 @@
if (child.op() != GetLocal)
return;
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
- dataLog(" Considering GetLocal at @%u.\n", edge.index());
+ dataLog(" Considering GetLocal at @%u, local r%d.\n", edge.index(), child.local());
#endif
if (child.variableAccessData()->isCaptured()) {
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
@@ -302,6 +302,10 @@
#endif
ASSERT(originalNodeIndex != NoNode);
Node* originalNode = &m_graph[originalNodeIndex];
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+ dataLog(" Original has local r%d.\n", originalNode->local());
+#endif
+ ASSERT(child.local() == originalNode->local());
if (changeRef)
ASSERT(originalNode->shouldGenerate());
// Possibilities:
@@ -600,6 +604,8 @@
NodeIndex nodeIndex = secondBlock->at(i);
Node& node = m_graph[nodeIndex];
+ bool childrenAlreadyFixed = false;
+
switch (node.op()) {
case Phantom: {
if (!node.child1())
@@ -611,8 +617,12 @@
NodeIndex setLocalIndex =
firstBlock->variablesAtTail.operand(possibleLocalOp.local());
Node& setLocal = m_graph[setLocalIndex];
- if (setLocal.op() == SetLocal)
+ if (setLocal.op() == SetLocal) {
m_graph.changeEdge(node.children.child1(), setLocal.child1());
+ ASSERT(!node.child2());
+ ASSERT(!node.child3());
+ childrenAlreadyFixed = true;
+ }
}
break;
}
@@ -632,6 +642,7 @@
NodeIndex atFirstIndex = firstBlock->variablesAtTail.operand(node.local());
m_graph.changeEdge(node.children.child1(), Edge(skipGetLocal(atFirstIndex)), node.shouldGenerate());
+ childrenAlreadyFixed = true;
if (node.op() != GetLocal)
break;
@@ -651,20 +662,22 @@
break;
}
- bool changeRef = node.shouldGenerate();
+ if (!childrenAlreadyFixed) {
+ bool changeRef = node.shouldGenerate();
- // If the child is a GetLocal, then we might like to fix it.
- if (node.flags() & NodeHasVarArgs) {
- for (unsigned childIdx = node.firstChild();
- childIdx < node.firstChild() + node.numChildren();
- ++childIdx)
- fixPossibleGetLocal(firstBlock, m_graph.m_varArgChildren[childIdx], changeRef);
- } else if (!!node.child1()) {
- fixPossibleGetLocal(firstBlock, node.children.child1(), changeRef);
- if (!!node.child2()) {
- fixPossibleGetLocal(firstBlock, node.children.child2(), changeRef);
- if (!!node.child3())
- fixPossibleGetLocal(firstBlock, node.children.child3(), changeRef);
+ // If the child is a GetLocal, then we might like to fix it.
+ if (node.flags() & NodeHasVarArgs) {
+ for (unsigned childIdx = node.firstChild();
+ childIdx < node.firstChild() + node.numChildren();
+ ++childIdx)
+ fixPossibleGetLocal(firstBlock, m_graph.m_varArgChildren[childIdx], changeRef);
+ } else if (!!node.child1()) {
+ fixPossibleGetLocal(firstBlock, node.children.child1(), changeRef);
+ if (!!node.child2()) {
+ fixPossibleGetLocal(firstBlock, node.children.child2(), changeRef);
+ if (!!node.child3())
+ fixPossibleGetLocal(firstBlock, node.children.child3(), changeRef);
+ }
}
}
