Title: [153540] trunk
- Revision
- 153540
- Author
- [email protected]
- Date
- 2013-07-31 13:24:23 -0700 (Wed, 31 Jul 2013)
Log Message
DFG doesn't account for inlining of functions with switch statements that haven't been executed by the baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=119349
Reviewed by Geoffrey Garen.
Source/_javascript_Core:
Prior to this patch, the baseline JIT was responsible for resizing the ctiOffsets Vector for
SimpleJumpTables to be equal to the size of the branchOffsets Vector. The DFG implicitly relied
on code it compiled with any switch statements to have been run in the baseline JIT first.
However, if the DFG chooses to inline a function that has never been compiled by the baseline
JIT then this resizing never happens and we crash at link time in the DFG.
We can fix this by also doing the resize in the DFG to catch this case.
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::link):
LayoutTests:
* fast/js/dfg-inline-switch-imm-expected.txt: Added.
* fast/js/dfg-inline-switch-imm.html: Added.
* fast/js/script-tests/dfg-inline-switch-imm.js: Added.
(foo):
(bar):
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (153539 => 153540)
--- trunk/LayoutTests/ChangeLog 2013-07-31 19:55:08 UTC (rev 153539)
+++ trunk/LayoutTests/ChangeLog 2013-07-31 20:24:23 UTC (rev 153540)
@@ -1,3 +1,16 @@
+2013-07-31 Mark Hahnenberg <[email protected]>
+
+ DFG doesn't account for inlining of functions with switch statements that haven't been executed by the baseline JIT
+ https://bugs.webkit.org/show_bug.cgi?id=119349
+
+ Reviewed by Geoffrey Garen.
+
+ * fast/js/dfg-inline-switch-imm-expected.txt: Added.
+ * fast/js/dfg-inline-switch-imm.html: Added.
+ * fast/js/script-tests/dfg-inline-switch-imm.js: Added.
+ (foo):
+ (bar):
+
2013-07-31 Tim Horton <[email protected]>
RenderEmbeddedObject::isReplacementObscured is wrong if an obscuring element has pointer-events: none set
Added: trunk/LayoutTests/fast/js/dfg-inline-switch-imm-expected.txt (0 => 153540)
--- trunk/LayoutTests/fast/js/dfg-inline-switch-imm-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-inline-switch-imm-expected.txt 2013-07-31 20:24:23 UTC (rev 153540)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-inline-switch-imm.html (0 => 153540)
--- trunk/LayoutTests/fast/js/dfg-inline-switch-imm.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-inline-switch-imm.html 2013-07-31 20:24:23 UTC (rev 153540)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/dfg-inline-switch-imm.js (0 => 153540)
--- trunk/LayoutTests/fast/js/script-tests/dfg-inline-switch-imm.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-inline-switch-imm.js 2013-07-31 20:24:23 UTC (rev 153540)
@@ -0,0 +1,33 @@
+function foo(a) {
+ switch (a) {
+ case 0:
+ return 0;
+ case 1:
+ return 1;
+ case 2:
+ return 2;
+ default:
+ return 3;
+ }
+}
+
+function bar(a, runFoo) {
+ if (runFoo)
+ return foo(a);
+ return 0;
+}
+
+noInline(bar);
+
+var sum = 0;
+
+for (var i = 0; i < 5; i++)
+ sum += bar(i, true);
+
+var i = 0;
+while (!dfgCompiled({f:bar})) {
+ sum += bar(i, false);
+ i++;
+}
+
+sum += bar(i, true);
Modified: trunk/Source/_javascript_Core/ChangeLog (153539 => 153540)
--- trunk/Source/_javascript_Core/ChangeLog 2013-07-31 19:55:08 UTC (rev 153539)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-07-31 20:24:23 UTC (rev 153540)
@@ -1,3 +1,21 @@
+2013-07-31 Mark Hahnenberg <[email protected]>
+
+ DFG doesn't account for inlining of functions with switch statements that haven't been executed by the baseline JIT
+ https://bugs.webkit.org/show_bug.cgi?id=119349
+
+ Reviewed by Geoffrey Garen.
+
+ Prior to this patch, the baseline JIT was responsible for resizing the ctiOffsets Vector for
+ SimpleJumpTables to be equal to the size of the branchOffsets Vector. The DFG implicitly relied
+ on code it compiled with any switch statements to have been run in the baseline JIT first.
+ However, if the DFG chooses to inline a function that has never been compiled by the baseline
+ JIT then this resizing never happens and we crash at link time in the DFG.
+
+ We can fix this by also doing the resize in the DFG to catch this case.
+
+ * dfg/DFGJITCompiler.cpp:
+ (JSC::DFG::JITCompiler::link):
+
2013-07-31 Gavin Barraclough <[email protected]>
Speculative Windows build fix.
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCompiler.cpp (153539 => 153540)
--- trunk/Source/_javascript_Core/dfg/DFGJITCompiler.cpp 2013-07-31 19:55:08 UTC (rev 153539)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCompiler.cpp 2013-07-31 20:24:23 UTC (rev 153540)
@@ -171,6 +171,7 @@
usedJumpTables.set(data.switchTableIndex);
SimpleJumpTable& table = m_codeBlock->switchJumpTable(data.switchTableIndex);
table.ctiDefault = linkBuffer.locationOf(m_blockHeads[data.fallThrough->index]);
+ table.ctiOffsets.grow(table.branchOffsets.size());
for (unsigned j = table.ctiOffsets.size(); j--;)
table.ctiOffsets[j] = table.ctiDefault;
for (unsigned j = data.cases.size(); j--;) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
