Changeset 197686 in webkit

Timestamp:

Mar 7, 2016, 10:24:26 AM (11 years ago)

Author:

akling@apple.com

Message:

REGRESSION (r197303): Web Inspector crashes web process when inspecting an element on TOT
<​https://webkit.org/b/154812>

Reviewed by Geoffrey Garen.

Guard against null pointer dereference for UnlinkedCodeBlocks that don't have any control flow
profiling data.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (1 diff)
• bytecode/UnlinkedCodeBlock.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-03-07  Andreas Kling  <akling@apple.com>
+
+        REGRESSION (r197303): Web Inspector crashes web process when inspecting an element on TOT
+        <https://webkit.org/b/154812>
+
+        Reviewed by Geoffrey Garen.
+
+        Guard against null pointer dereference for UnlinkedCodeBlocks that don't have any control flow
+        profiling data.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets):
+
 2016-03-07  Benjamin Poulain  <benjamin@webkit.org>
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -4211 +4211 @@
 void CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler(RefCountedArray<Instruction>& instructions)
 {
+    if (!unlinkedCodeBlock()->hasOpProfileControlFlowBytecodeOffsets())
+        return;
     const Vector<size_t>& bytecodeOffsets = unlinkedCodeBlock()->opProfileControlFlowBytecodeOffsets();
     for (size_t i = 0, offsetsLength = bytecodeOffsets.size(); i < offsetsLength; i++) {

trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h

@@ -355 +355 @@
         ASSERT(m_rareData);
         return m_rareData->m_opProfileControlFlowBytecodeOffsets;
+    }
+    bool hasOpProfileControlFlowBytecodeOffsets() const
+    {
+        return m_rareData && !m_rareData->m_opProfileControlFlowBytecodeOffsets.isEmpty();
     }