[webkit-changes] [189309] branches/safari-601-branch/Source/JavaScriptCore

Thu, 03 Sep 2015 16:09:02 -0700

Title: [189309] branches/safari-601-branch/Source/_javascript_Core

Diff

Modified: branches/safari-601-branch/Source/_javascript_Core/ChangeLog (189308 => 189309)


--- branches/safari-601-branch/Source/_javascript_Core/ChangeLog	2015-09-03 23:06:27 UTC (rev 189308)
+++ branches/safari-601-branch/Source/_javascript_Core/ChangeLog	2015-09-03 23:08:39 UTC (rev 189309)
@@ -1,3 +1,26 @@
+2015-09-03  Babak Shafiei  <[email protected]>
+
+        Merge r188067.
+
+    2015-08-06  Filip Pizlo  <[email protected]>
+
+            Structures used for tryGetConstantProperty() should be registered first
+            https://bugs.webkit.org/show_bug.cgi?id=147750
+
+            Reviewed by Saam Barati and Michael Saboff.
+
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::tryGetConstantProperty): Add an assertion to that effect. This should catch the bug sooner.
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::addStructureSet): Register structures when we make a structure set. That ensures that we won't call tryGetConstantProperty() on a structure that hasn't been registered yet.
+            * dfg/DFGStructureRegistrationPhase.cpp:
+            (JSC::DFG::StructureRegistrationPhase::run): Don't register structure sets here anymore. Registering them before we get here means there is no chance of the code being DCE'd before the structures get registered. It also enables the tryGetConstantProperty() assertion, since that code runs before StructureRegisterationPhase.
+            (JSC::DFG::StructureRegistrationPhase::registerStructures):
+            (JSC::DFG::StructureRegistrationPhase::registerStructure):
+            (JSC::DFG::StructureRegistrationPhase::assertAreRegistered):
+            (JSC::DFG::StructureRegistrationPhase::assertIsRegistered):
+            (JSC::DFG::performStructureRegistration):
+
 2015-08-27  Matthew Hanson  <[email protected]>
 
         Merge r189012. rdar://problem/22084478

Modified: branches/safari-601-branch/Source/_javascript_Core/dfg/DFGGraph.cpp (189308 => 189309)


--- branches/safari-601-branch/Source/_javascript_Core/dfg/DFGGraph.cpp	2015-09-03 23:06:27 UTC (rev 189308)
+++ branches/safari-601-branch/Source/_javascript_Core/dfg/DFGGraph.cpp	2015-09-03 23:08:39 UTC (rev 189309)
@@ -976,6 +976,8 @@
     
     for (unsigned i = structureSet.size(); i--;) {
         Structure* structure = structureSet[i];
+        assertIsRegistered(structure);
+        
         WatchpointSet* set = structure->propertyReplacementWatchpointSet(offset);
         if (!set || !set->isStillValid())
             return JSValue();

Modified: branches/safari-601-branch/Source/_javascript_Core/dfg/DFGGraph.h (189308 => 189309)


--- branches/safari-601-branch/Source/_javascript_Core/dfg/DFGGraph.h	2015-09-03 23:06:27 UTC (rev 189308)
+++ branches/safari-601-branch/Source/_javascript_Core/dfg/DFGGraph.h	2015-09-03 23:08:39 UTC (rev 189309)
@@ -326,6 +326,8 @@
     StructureSet* addStructureSet(const StructureSet& structureSet)
     {
         ASSERT(structureSet.size());
+        for (Structure* structure : structureSet)
+            registerStructure(structure);
         m_structureSet.append(structureSet);
         return &m_structureSet.last();
     }

Modified: branches/safari-601-branch/Source/_javascript_Core/dfg/DFGStructureRegistrationPhase.cpp (189308 => 189309)


--- branches/safari-601-branch/Source/_javascript_Core/dfg/DFGStructureRegistrationPhase.cpp	2015-09-03 23:06:27 UTC (rev 189308)
+++ branches/safari-601-branch/Source/_javascript_Core/dfg/DFGStructureRegistrationPhase.cpp	2015-09-03 23:08:39 UTC (rev 189309)
@@ -57,7 +57,7 @@
         registerStructure(m_graph.m_vm.getterSetterStructure.get());
         
         for (FrozenValue* value : m_graph.m_frozenValues)
-            m_graph.assertIsRegistered(value->structure());
+            assertIsRegistered(value->structure());
         
         for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
             BasicBlock* block = m_graph.block(blockIndex);
@@ -69,7 +69,7 @@
             
                 switch (node->op()) {
                 case CheckStructure:
-                    registerStructures(node->structureSet());
+                    assertAreRegistered(node->structureSet());
                     break;
                 
                 case NewObject:
@@ -152,8 +152,8 @@
 private:
     void registerStructures(const StructureSet& set)
     {
-        for (unsigned i = set.size(); i--;)
-            registerStructure(set[i]);
+        for (Structure* structure : set)
+            registerStructure(structure);
     }
     
     void registerStructure(Structure* structure)
@@ -161,6 +161,18 @@
         if (structure)
             m_graph.registerStructure(structure);
     }
+
+    void assertAreRegistered(const StructureSet& set)
+    {
+        for (Structure* structure : set)
+            assertIsRegistered(structure);
+    }
+
+    void assertIsRegistered(Structure* structure)
+    {
+        if (structure)
+            m_graph.assertIsRegistered(structure);
+    }
 };
 
 bool performStructureRegistration(Graph& graph)

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to