Changeset 258381 in webkit

Timestamp:

Mar 12, 2020, 9:16:36 PM (6 years ago)

Author:

keith_miller@apple.com

Message:

DFG nodes that take a TypedArray's storage need to keepAlive the TypedArray
​https://bugs.webkit.org/show_bug.cgi?id=209035

Reviewed by Saam Barati.

It might be possible to produce a graph where the last reference to a TypedArray
is via a GetByVal or PutByVal. Since those nodes don't create any reference to the
TypedArray in B3 we may end up not keeping the TypedArray alive until after the
storage access.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLLowerDFGToB3.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-03-12  Keith Miller  <keith_miller@apple.com>
+
+        DFG nodes that take a TypedArray's storage need to keepAlive the TypedArray
+        https://bugs.webkit.org/show_bug.cgi?id=209035
+
+        Reviewed by Saam Barati.
+
+        It might be possible to produce a graph where the last reference to a TypedArray
+        is via a GetByVal or PutByVal. Since those nodes don't create any reference to the
+        TypedArray in B3 we may end up not keeping the TypedArray alive until after the
+        storage access.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
+
 2020-03-12  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -3839 +3839 @@
         // array buffer storage.
         m_heaps.decorateFencedAccess(&m_heaps.typedArrayProperties, atomicValue);
-        
+
+        // We have to keep base alive since that keeps storage alive.
+        keepAlive(lowCell(baseEdge));
         setIntTypedArrayLoadResult(result, type);
     }
@@ -4694 +4696 @@
         case Array::Float32Array:
         case Array::Float64Array: {
+            LValue base = lowCell(m_graph.varArgChild(m_node, 0));
             LValue index = lowInt32(m_graph.varArgChild(m_node, 1));
             LValue storage = lowStorage(m_graph.varArgChild(m_node, 2));
@@ -4723 +4726 @@
                 }
                 
+                // We have to keep base alive since that keeps storage alive.
+                keepAlive(base);
                 setDouble(result);
                 return;
@@ -5089 +5094 @@
                 }
                 
+                // We have to keep base alive since that keeps storage alive.
+                keepAlive(base);
                 return;
             }