Title: [156192] trunk/Source/_javascript_Core
- Revision
- 156192
- Author
- [email protected]
- Date
- 2013-09-20 13:23:33 -0700 (Fri, 20 Sep 2013)
Log Message
Clobberize phase forgets to indicate that it writes GCState for several node types
https://bugs.webkit.org/show_bug.cgi?id=121702
Reviewed by Oliver Hunt.
Added read and write for GCState to the nodes that could end up allocating (and thereby
cause a garbage collection).
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (156191 => 156192)
--- trunk/Source/_javascript_Core/ChangeLog 2013-09-20 20:13:11 UTC (rev 156191)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-09-20 20:23:33 UTC (rev 156192)
@@ -1,3 +1,16 @@
+2013-09-20 Mark Hahnenberg <[email protected]>
+
+ Clobberize phase forgets to indicate that it writes GCState for several node types
+ https://bugs.webkit.org/show_bug.cgi?id=121702
+
+ Reviewed by Oliver Hunt.
+
+ Added read and write for GCState to the nodes that could end up allocating (and thereby
+ cause a garbage collection).
+
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+
2013-09-19 Filip Pizlo <[email protected]>
Move CCallHelpers and AssemblyHelpers into jit/ and have JSInterfaceJIT use them
Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (156191 => 156192)
--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2013-09-20 20:13:11 UTC (rev 156191)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2013-09-20 20:23:33 UTC (rev 156192)
@@ -126,8 +126,6 @@
case SetArgument:
case InlineStart:
case Breakpoint:
- case CreateActivation:
- case CreateArguments:
case PhantomArguments:
case Jump:
case Branch:
@@ -143,6 +141,13 @@
write(SideState);
return;
+ case CreateActivation:
+ case CreateArguments:
+ write(SideState);
+ read(GCState);
+ write(GCState);
+ return;
+
// These are forward-exiting nodes that assume that the subsequent instruction
// is a MovHint, and they try to roll forward over this MovHint in their
// execution. This makes hoisting them impossible without additional magic. We
@@ -152,8 +157,13 @@
write(SideState);
return;
+ case ToThis:
case CreateThis:
- case ToThis:
+ read(MiscFields);
+ read(GCState);
+ write(GCState);
+ return;
+
case VarInjectionWatchpoint:
case AllocationProfileWatchpoint:
case IsObject:
@@ -415,11 +425,15 @@
case AllocatePropertyStorage:
write(JSObject_butterfly);
+ read(GCState);
+ write(GCState);
return;
case ReallocatePropertyStorage:
read(JSObject_butterfly);
write(JSObject_butterfly);
+ read(GCState);
+ write(GCState);
return;
case GetButterfly:
@@ -432,6 +446,8 @@
read(JSObject_butterfly);
write(JSCell_structure);
write(JSObject_butterfly);
+ read(GCState);
+ write(GCState);
return;
case GetIndexedPropertyStorage:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
