⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 157954 in webkit


Ignore:
Timestamp:
Oct 24, 2013, 2:23:04 PM (13 years ago)
Author:
Lucas Forschler
Message:

Merge fix for <rdar://problem/15109389>

Location:
branches/safari-537.73-branch
Files:
3 added
11 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-537.73-branch/LayoutTests/ChangeLog

    r157765 r157954  
     12013-10-24  Oliver Hunt  <oliver@apple.com>
     2
     3        <https://webkit.org/b/119860> Crash during exception unwinding
     4
     5        Reviewed by Filip Pizlo.
     6
     7        Add a test
     8
     9        * fast/js/dfg-activation-register-overwritten-in-throw-expected.txt: Added.
     10        * fast/js/dfg-activation-register-overwritten-in-throw.html: Added.
     11        * fast/js/script-tests/dfg-activation-register-overwritten-in-throw.js: Added.
     12        (g):
     13
    1142013-10-21  Lucas Forschler  <lforschler@apple.com>
    215

  • branches/safari-537.73-branch/Source/JavaScriptCore/ChangeLog

    r157765 r157954  
     12013-10-24  Oliver Hunt  <oliver@apple.com>
     2
     3        <https://webkit.org/b/119860> Crash during exception unwinding
     4
     5        Reviewed by Filip Pizlo.
     6
     7        Add an "Unreachable" NodeType, and then rearrange op_throw and op_throw_reference_error
     8        to plant Throw or ThrowReferenceError followed by a flush and then the Unreachable node.
     9
     10        We need this so that Throw and ThrowReferenceError no longer need to be treated as
     11        terminals and the subsequent flush keeps the activation (and other registers) live.
     12
     13        * dfg/DFGAbstractInterpreterInlines.h:
     14        (JSC::DFG::::executeEffects):
     15        * dfg/DFGByteCodeParser.cpp:
     16        (JSC::DFG::ByteCodeParser::parseBlock):
     17        * dfg/DFGClobberize.h:
     18        (JSC::DFG::clobberize):
     19        * dfg/DFGFixupPhase.cpp:
     20        (JSC::DFG::FixupPhase::fixupNode):
     21        * dfg/DFGNode.h:
     22        (JSC::DFG::Node::isTerminal):
     23        * dfg/DFGNodeType.h:
     24        * dfg/DFGPredictionPropagationPhase.cpp:
     25        (JSC::DFG::PredictionPropagationPhase::propagate):
     26        * dfg/DFGSafeToExecute.h:
     27        (JSC::DFG::safeToExecute):
     28        * dfg/DFGSpeculativeJIT32_64.cpp:
     29        (JSC::DFG::SpeculativeJIT::compile):
     30        * dfg/DFGSpeculativeJIT64.cpp:
     31        (JSC::DFG::SpeculativeJIT::compile):
     32
    1332013-10-21  Lucas Forschler  <lforschler@apple.com>
    234

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

    r153675 r157954  
    15301530        forNode(node).set(SpecBoolean);
    15311531        break;
    1532            
     1532
    15331533    case Phi:
    15341534    case Flush:
    … …  
    15511551        clobberWorld(node->codeOrigin, indexInBlock);
    15521552        forNode(node).makeTop();
     1553        break;
     1554
     1555    case Unreachable:
     1556        RELEASE_ASSERT_NOT_REACHED();
    15531557        break;
    15541558
    … …  
    17781782       
    17791783    case Return:
    1780     case Throw:
    1781     case ThrowReferenceError:
     1784    case Unreachable:
    17821785        ASSERT(basicBlock->cfaBranchDirection == InvalidBranchDirection);
    17831786        return false;

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r153626 r157954  
    30323032
    30333033        case op_throw:
     3034            addToGraph(Throw, get(currentInstruction[1].u.operand));
    30343035            flushAllArgumentsAndCapturedVariablesInInlineStack();
    3035             addToGraph(Throw, get(currentInstruction[1].u.operand));
     3036            addToGraph(Unreachable);
    30363037            LAST_OPCODE(op_throw);
    30373038           
    30383039        case op_throw_static_error:
     3040            addToGraph(ThrowReferenceError);
    30393041            flushAllArgumentsAndCapturedVariablesInInlineStack();
    3040             addToGraph(ThrowReferenceError);
     3042            addToGraph(Unreachable);
    30413043            LAST_OPCODE(op_throw_static_error);
    30423044           

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

    r148696 r157954  
    435435            switch (node->op()) {
    436436            case Return:
    437             case Throw:
    438             case ThrowReferenceError:
     437            case Unreachable:
    439438            case ForceOSRExit:
    440439                // Do nothing. These nodes will already do the right thing.

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r153090 r157954  
    874874        case ForceOSRExit:
    875875        case CheckWatchdogTimer:
     876        case Unreachable:
    876877            break;
    877878#else

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGNode.h

    r152799 r157954  
    677677        case Branch:
    678678        case Return:
    679         case Throw:
    680         case ThrowReferenceError:
     679        case Unreachable:
    681680            return true;
    682681        default:

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGNodeType.h

    r149162 r157954  
    251251    macro(NewFunctionExpression, NodeResultJS) \
    252252    \
     253    /* These aren't terminals but always exit */ \
     254    macro(Throw, NodeMustGenerate) \
     255    macro(ThrowReferenceError, NodeMustGenerate) \
     256    \
    253257    /* Block terminals. */\
    254258    macro(Jump, NodeMustGenerate) \
    255259    macro(Branch, NodeMustGenerate) \
    256260    macro(Return, NodeMustGenerate) \
    257     macro(Throw, NodeMustGenerate) \
    258     macro(ThrowReferenceError, NodeMustGenerate) \
     261    macro(Unreachable, NodeMustGenerate) \
    259262    \
    260263    macro(GarbageValue, NodeResultJS | NodeClobbersWorld) \

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r153442 r157954  
    540540        case PutGlobalVarCheck:
    541541        case CheckWatchdogTimer:
     542        case Unreachable:
    542543            break;
    543544           

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r153802 r157954  
    49564956        break;
    49574957
     4958    case Unreachable:
     4959        RELEASE_ASSERT_NOT_REACHED();
     4960        break;
     4961
    49584962    case Nop:
    49594963    case LastNodeType:

  • branches/safari-537.73-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r153803 r157954  
    47904790        noResult(node);
    47914791        break;
     4792
     4793    case Unreachable:
     4794        RELEASE_ASSERT_NOT_REACHED();
     4795        break;
    47924796       
    47934797    case Nop:
Note: See TracChangeset for help on using the changeset viewer.