[webkit-changes] [188783] branches/safari-601.1.46-branch/Source/JavaScriptCore

Fri, 21 Aug 2015 14:57:11 -0700

Title: [188783] branches/safari-601.1.46-branch/Source/_javascript_Core

Diff

Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/ChangeLog (188782 => 188783)


--- branches/safari-601.1.46-branch/Source/_javascript_Core/ChangeLog	2015-08-21 21:54:23 UTC (rev 188782)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/ChangeLog	2015-08-21 21:56:29 UTC (rev 188783)
@@ -1,3 +1,26 @@
+2015-08-21  Babak Shafiei  <[email protected]>
+
+        Merge r188067.
+
+    2015-08-06  Filip Pizlo  <[email protected]>
+
+            Structures used for tryGetConstantProperty() should be registered first
+            https://bugs.webkit.org/show_bug.cgi?id=147750
+
+            Reviewed by Saam Barati and Michael Saboff.
+
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::tryGetConstantProperty): Add an assertion to that effect. This should catch the bug sooner.
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::addStructureSet): Register structures when we make a structure set. That ensures that we won't call tryGetConstantProperty() on a structure that hasn't been registered yet.
+            * dfg/DFGStructureRegistrationPhase.cpp:
+            (JSC::DFG::StructureRegistrationPhase::run): Don't register structure sets here anymore. Registering them before we get here means there is no chance of the code being DCE'd before the structures get registered. It also enables the tryGetConstantProperty() assertion, since that code runs before StructureRegisterationPhase.
+            (JSC::DFG::StructureRegistrationPhase::registerStructures):
+            (JSC::DFG::StructureRegistrationPhase::registerStructure):
+            (JSC::DFG::StructureRegistrationPhase::assertAreRegistered):
+            (JSC::DFG::StructureRegistrationPhase::assertIsRegistered):
+            (JSC::DFG::performStructureRegistration):
+
 2015-07-31  Lucas Forschler  <[email protected]>
 
         Merge r187579

Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGGraph.cpp (188782 => 188783)


--- branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGGraph.cpp	2015-08-21 21:54:23 UTC (rev 188782)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGGraph.cpp	2015-08-21 21:56:29 UTC (rev 188783)
@@ -976,6 +976,8 @@
     
     for (unsigned i = structureSet.size(); i--;) {
         Structure* structure = structureSet[i];
+        assertIsRegistered(structure);
+        
         WatchpointSet* set = structure->propertyReplacementWatchpointSet(offset);
         if (!set || !set->isStillValid())
             return JSValue();

Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGGraph.h (188782 => 188783)


--- branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGGraph.h	2015-08-21 21:54:23 UTC (rev 188782)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGGraph.h	2015-08-21 21:56:29 UTC (rev 188783)
@@ -326,6 +326,8 @@
     StructureSet* addStructureSet(const StructureSet& structureSet)
     {
         ASSERT(structureSet.size());
+        for (Structure* structure : structureSet)
+            registerStructure(structure);
         m_structureSet.append(structureSet);
         return &m_structureSet.last();
     }

Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGStructureRegistrationPhase.cpp (188782 => 188783)


--- branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGStructureRegistrationPhase.cpp	2015-08-21 21:54:23 UTC (rev 188782)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGStructureRegistrationPhase.cpp	2015-08-21 21:56:29 UTC (rev 188783)
@@ -57,7 +57,7 @@
         registerStructure(m_graph.m_vm.getterSetterStructure.get());
         
         for (FrozenValue* value : m_graph.m_frozenValues)
-            m_graph.assertIsRegistered(value->structure());
+            assertIsRegistered(value->structure());
         
         for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
             BasicBlock* block = m_graph.block(blockIndex);
@@ -69,7 +69,7 @@
             
                 switch (node->op()) {
                 case CheckStructure:
-                    registerStructures(node->structureSet());
+                    assertAreRegistered(node->structureSet());
                     break;
                 
                 case NewObject:
@@ -152,8 +152,8 @@
 private:
     void registerStructures(const StructureSet& set)
     {
-        for (unsigned i = set.size(); i--;)
-            registerStructure(set[i]);
+        for (Structure* structure : set)
+            registerStructure(structure);
     }
     
     void registerStructure(Structure* structure)
@@ -161,6 +161,18 @@
         if (structure)
             m_graph.registerStructure(structure);
     }
+
+    void assertAreRegistered(const StructureSet& set)
+    {
+        for (Structure* structure : set)
+            assertIsRegistered(structure);
+    }
+
+    void assertIsRegistered(Structure* structure)
+    {
+        if (structure)
+            m_graph.assertIsRegistered(structure);
+    }
 };
 
 bool performStructureRegistration(Graph& graph)

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to