Changeset 236495 in webkit

Timestamp:

Sep 25, 2018, 8:14:09 PM (8 years ago)

Author:

sbarati@apple.com

Message:

Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
​https://bugs.webkit.org/show_bug.cgi?id=189940
<rdar://problem/43640987>

Reviewed by Mark Lam.

JSTests:

• stress/use-baseline-codeblock-materialize-osr-exit.js: Added.

Source/JavaScriptCore:

We were calling baselineCodeBlockForOriginAndBaselineCodeBlock with the FTL
CodeBlock. There is nothing semantically wrong with doing that (except for
poor naming), however, the poor naming here led us to make a real semantic
mistake. We wanted the baseline CodeBlock's constant pool, but we were
accessing the FTL CodeBlock's constant pool accidentally. We need to
access the baseline CodeBlock's constant pool when we update the NewArrayBuffer
constant value.

• bytecode/InlineCallFrame.h:

(JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):

• ftl/FTLOperations.cpp:

(JSC::FTL::operationMaterializeObjectInOSR):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/use-baseline-codeblock-materialize-osr-exit.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/bytecode/InlineCallFrame.h (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLOperations.cpp (modified) (6 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-09-25  Saam Barati  <sbarati@apple.com>
+
+        Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=189940
+        <rdar://problem/43640987>
+
+        Reviewed by Mark Lam.
+
+        * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
+
 2018-09-24  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-09-25  Saam Barati  <sbarati@apple.com>
+
+        Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=189940
+        <rdar://problem/43640987>
+
+        Reviewed by Mark Lam.
+
+        We were calling baselineCodeBlockForOriginAndBaselineCodeBlock with the FTL
+        CodeBlock. There is nothing semantically wrong with doing that (except for
+        poor naming), however, the poor naming here led us to make a real semantic
+        mistake. We wanted the baseline CodeBlock's constant pool, but we were
+        accessing the FTL CodeBlock's constant pool accidentally. We need to
+        access the baseline CodeBlock's constant pool when we update the NewArrayBuffer
+        constant value.
+
+        * bytecode/InlineCallFrame.h:
+        (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+
 2018-09-25  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h

@@ -241 +241 @@
 inline CodeBlock* baselineCodeBlockForOriginAndBaselineCodeBlock(const CodeOrigin& codeOrigin, CodeBlock* baselineCodeBlock)
 {
+    ASSERT(baselineCodeBlock->jitType() == JITCode::BaselineJIT);
     if (codeOrigin.inlineCallFrame)
         return baselineCodeBlockForInlineCallFrame(codeOrigin.inlineCallFrame);

trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

@@ -226 +226 @@
 
         CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
-            materialization->origin(), exec->codeBlock());
+            materialization->origin(), exec->codeBlock()->baselineAlternative());
         Structure* structure = codeBlock->globalObject()->activationStructure();
 
@@ -287 +287 @@
             case PhantomCreateRest: {
                 CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
-                    materialization->origin(), exec->codeBlock());
+                    materialization->origin(), exec->codeBlock()->baselineAlternative());
 
                 unsigned numberOfArgumentsToSkip = codeBlock->numberOfArgumentsToSkip();
@@ -331 +331 @@
         
         CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
-            materialization->origin(), exec->codeBlock());
+            materialization->origin(), exec->codeBlock()->baselineAlternative());
         
         // We have an inline frame and we have all of the data we need to recreate it.
@@ -474 +474 @@
         // For now, we use array allocation profile in the actual CodeBlock. It is OK since current NewArrayBuffer
         // and PhantomNewArrayBuffer are always bound to a specific op_new_array_buffer.
-        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(materialization->origin(), exec->codeBlock());
+        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(materialization->origin(), exec->codeBlock()->baselineAlternative());
         Instruction* currentInstruction = &codeBlock->instructions()[materialization->origin().bytecodeIndex];
         RELEASE_ASSERT(Interpreter::getOpcodeID(currentInstruction[0].u.opcode) == op_new_array_buffer);
@@ -507 +507 @@
     case PhantomNewArrayWithSpread: {
         CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
-            materialization->origin(), exec->codeBlock());
+            materialization->origin(), exec->codeBlock()->baselineAlternative());
         JSGlobalObject* globalObject = codeBlock->globalObject();
         Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
@@ -586 +586 @@
         }
         RELEASE_ASSERT(regExp);
-        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(materialization->origin(), exec->codeBlock());
+        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(materialization->origin(), exec->codeBlock()->baselineAlternative());
         Structure* structure = codeBlock->globalObject()->regExpStructure();
         return RegExpObject::create(vm, structure, regExp);