Changeset 238499 in webkit

Timestamp:

Nov 26, 2018, 10:15:18 AM (8 years ago)

Author:

Tadeu Zagallo

Message:

ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
​https://bugs.webkit.org/show_bug.cgi?id=191716
<rdar://problem/45723878>

Reviewed by Saam Barati.

JSTests:

• stress/regress-187373.js: Added.

(async.fn):

Source/JavaScriptCore:

After ​https://bugs.webkit.org/show_bug.cgi?id=187373, when updating
jump targets during generatorification, we only stored the new jump
target when it changed. However, the out-of-line jump targets are
cleared at the beginning of the pass, so we need to store it
unconditionally.

• bytecode/PreciseJumpTargetsInlines.h:

(JSC::extractStoredJumpTargetsForInstruction):
(JSC::updateStoredJumpTargetsForInstruction):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regress-187373.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/bytecode/PreciseJumpTargetsInlines.h (modified) (5 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
+
+        ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
+        https://bugs.webkit.org/show_bug.cgi?id=191716
+        <rdar://problem/45723878>
+
+        Reviewed by Saam Barati.
+
+        * stress/regress-187373.js: Added.
+        (async.fn):
+
 2018-11-21  Saam barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
+
+        ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
+        https://bugs.webkit.org/show_bug.cgi?id=191716
+        <rdar://problem/45723878>
+
+        Reviewed by Saam Barati.
+
+        After https://bugs.webkit.org/show_bug.cgi?id=187373, when updating
+        jump targets during generatorification, we only stored the new jump
+        target when it changed. However, the out-of-line jump targets are
+        cleared at the beginning of the pass, so we need to store it
+        unconditionally.
+
+        * bytecode/PreciseJumpTargetsInlines.h:
+        (JSC::extractStoredJumpTargetsForInstruction):
+        (JSC::updateStoredJumpTargetsForInstruction):
+
 2018-11-23  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/PreciseJumpTargetsInlines.h

@@ -113 +113 @@
 
 template<typename Block, typename Function>
-inline void extractStoredJumpTargetsForInstruction(Block&& codeBlock, const InstructionStream::Ref& instruction, Function function)
+inline void extractStoredJumpTargetsForInstruction(Block&& codeBlock, const InstructionStream::Ref& instruction, const Function& function)
 {
 #define CASE_OP(__op) \
@@ -134 +134 @@
 
 template<typename Block, typename Function, typename CodeBlockOrHashMap>
-inline void updateStoredJumpTargetsForInstruction(Block&& codeBlock, unsigned finalOffset, InstructionStream::MutableRef instruction, Function function, CodeBlockOrHashMap codeBlockOrHashMap)
+inline void updateStoredJumpTargetsForInstruction(Block&& codeBlock, unsigned finalOffset, InstructionStream::MutableRef instruction, const Function& function, CodeBlockOrHashMap& codeBlockOrHashMap)
 {
 #define CASE_OP(__op) \
@@ -140 +140 @@
         int32_t target = jumpTargetForInstruction<__op>(codeBlockOrHashMap, instruction); \
         int32_t newTarget = function(target); \
-        if (newTarget != target || finalOffset) { \
-            instruction->cast<__op>()->setTarget(BoundLabel(newTarget), [&]() { \
-                codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
-                return BoundLabel(); \
-            }); \
-        } \
+        instruction->cast<__op>()->setTarget(BoundLabel(newTarget), [&]() { \
+            codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
+            return BoundLabel(); \
+        }); \
         break; \
     }
@@ -152 +150 @@
     do { \
         int32_t target = __target; \
-        int32_t newTarget = function(target); \
-        if (newTarget != target) \
-            __target = newTarget; \
+        __target = function(target); \
     } while (false)
 
@@ -161 +157 @@
         int32_t target = jumpTargetForInstruction(codeBlockOrHashMap, instruction, bytecode.defaultOffset); \
         int32_t newTarget = function(target); \
-        if (newTarget != target || finalOffset) { \
-            instruction->cast<__op>()->setDefaultOffset(BoundLabel(newTarget), [&]() { \
-                codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
-                return BoundLabel(); \
-            }); \
-        } \
+        instruction->cast<__op>()->setDefaultOffset(BoundLabel(newTarget), [&]() { \
+            codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
+            return BoundLabel(); \
+        }); \
     } while (false)