Structures used for tryGetConstantProperty() should be registered first
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 6 Aug 2015 22:36:34 +0000 (22:36 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 6 Aug 2015 22:36:34 +0000 (22:36 +0000)
https://bugs.webkit.org/show_bug.cgi?id=147750

Reviewed by Saam Barati and Michael Saboff.

* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::tryGetConstantProperty): Add an assertion to that effect. This should catch the bug sooner.
* dfg/DFGGraph.h:
(JSC::DFG::Graph::addStructureSet): Register structures when we make a structure set. That ensures that we won't call tryGetConstantProperty() on a structure that hasn't been registered yet.
* dfg/DFGStructureRegistrationPhase.cpp:
(JSC::DFG::StructureRegistrationPhase::run): Don't register structure sets here anymore. Registering them before we get here means there is no chance of the code being DCE'd before the structures get registered. It also enables the tryGetConstantProperty() assertion, since that code runs before StructureRegisterationPhase.
(JSC::DFG::StructureRegistrationPhase::registerStructures):
(JSC::DFG::StructureRegistrationPhase::registerStructure):
(JSC::DFG::StructureRegistrationPhase::assertAreRegistered):
(JSC::DFG::StructureRegistrationPhase::assertIsRegistered):
(JSC::DFG::performStructureRegistration):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@188067 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGGraph.cpp
Source/JavaScriptCore/dfg/DFGGraph.h
Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp

index 4911673..09d7856 100644 (file)
@@ -1,3 +1,22 @@
+2015-08-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Structures used for tryGetConstantProperty() should be registered first
+        https://bugs.webkit.org/show_bug.cgi?id=147750
+
+        Reviewed by Saam Barati and Michael Saboff.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetConstantProperty): Add an assertion to that effect. This should catch the bug sooner.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addStructureSet): Register structures when we make a structure set. That ensures that we won't call tryGetConstantProperty() on a structure that hasn't been registered yet.
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run): Don't register structure sets here anymore. Registering them before we get here means there is no chance of the code being DCE'd before the structures get registered. It also enables the tryGetConstantProperty() assertion, since that code runs before StructureRegisterationPhase.
+        (JSC::DFG::StructureRegistrationPhase::registerStructures):
+        (JSC::DFG::StructureRegistrationPhase::registerStructure):
+        (JSC::DFG::StructureRegistrationPhase::assertAreRegistered):
+        (JSC::DFG::StructureRegistrationPhase::assertIsRegistered):
+        (JSC::DFG::performStructureRegistration):
+
 2015-08-06  Keith Miller  <keith_miller@apple.com>
 
         Remove UnspecifiedBoolType from JSC
index e2c4f01..0ee73f4 100644 (file)
@@ -1002,6 +1002,8 @@ JSValue Graph::tryGetConstantProperty(
     
     for (unsigned i = structureSet.size(); i--;) {
         Structure* structure = structureSet[i];
+        assertIsRegistered(structure);
+        
         WatchpointSet* set = structure->propertyReplacementWatchpointSet(offset);
         if (!set || !set->isStillValid())
             return JSValue();
index 57b3fff..e9926db 100644 (file)
@@ -325,6 +325,8 @@ public:
     
     StructureSet* addStructureSet(const StructureSet& structureSet)
     {
+        for (Structure* structure : structureSet)
+            registerStructure(structure);
         m_structureSet.append(structureSet);
         return &m_structureSet.last();
     }
index cf5707f..3a9a488 100644 (file)
@@ -57,7 +57,7 @@ public:
         registerStructure(m_graph.m_vm.getterSetterStructure.get());
         
         for (FrozenValue* value : m_graph.m_frozenValues)
-            m_graph.assertIsRegistered(value->structure());
+            assertIsRegistered(value->structure());
         
         for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
             BasicBlock* block = m_graph.block(blockIndex);
@@ -69,7 +69,7 @@ public:
             
                 switch (node->op()) {
                 case CheckStructure:
-                    registerStructures(node->structureSet());
+                    assertAreRegistered(node->structureSet());
                     break;
                 
                 case NewObject:
@@ -145,8 +145,8 @@ public:
 private:
     void registerStructures(const StructureSet& set)
     {
-        for (unsigned i = set.size(); i--;)
-            registerStructure(set[i]);
+        for (Structure* structure : set)
+            registerStructure(structure);
     }
     
     void registerStructure(Structure* structure)
@@ -154,6 +154,18 @@ private:
         if (structure)
             m_graph.registerStructure(structure);
     }
+
+    void assertAreRegistered(const StructureSet& set)
+    {
+        for (Structure* structure : set)
+            assertIsRegistered(structure);
+    }
+
+    void assertIsRegistered(Structure* structure)
+    {
+        if (structure)
+            m_graph.assertIsRegistered(structure);
+    }
 };
 
 bool performStructureRegistration(Graph& graph)