Changeset 98398 in webkit

Timestamp:

Oct 25, 2011, 2:56:31 PM (15 years ago)

Author:

fpizlo@apple.com

Message:

Tiered compilation may introduce dangling pointers in constant buffers
​https://bugs.webkit.org/show_bug.cgi?id=70854

Reviewed by Oliver Hunt.

Tiered compilation now copies constant buffers, which fixes the regression in
​https://bugs.webkit.org/show_bug.cgi?id=70246. No new tests because this
regression relies on a subtle interleaving of optimized compilation and garbage
collection, and cannot be reproduced in a simple test.

This also adds some new debug support, which was used to fix this bug and is
likely to be useful in the future.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::copyDataFrom):
(JSC::CodeBlock::usesOpcode):

• bytecode/CodeBlock.h:
• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (2 diffs)
• bytecode/CodeBlock.h (modified) (1 diff)
• dfg/DFGGraph.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Tiered compilation may introduce dangling pointers in constant buffers
+        https://bugs.webkit.org/show_bug.cgi?id=70854
+
+        Reviewed by Oliver Hunt.
+        
+        Tiered compilation now copies constant buffers, which fixes the regression in
+        https://bugs.webkit.org/show_bug.cgi?id=70246. No new tests because this
+        regression relies on a subtle interleaving of optimized compilation and garbage
+        collection, and cannot be reproduced in a simple test.
+        
+        This also adds some new debug support, which was used to fix this bug and is
+        likely to be useful in the future.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::copyDataFrom):
+        (JSC::CodeBlock::usesOpcode):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
 2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1829 +1829 @@
     replaceExistingEntries(m_functionDecls, alternative->m_functionDecls);
     replaceExistingEntries(m_functionExprs, alternative->m_functionExprs);
+    if (!!m_rareData && !!alternative->m_rareData)
+        replaceExistingEntries(m_rareData->m_constantBuffers, alternative->m_rareData->m_constantBuffers);
 }
 
@@ -2003 +2005 @@
 #endif
 
+#ifndef NDEBUG
+bool CodeBlock::usesOpcode(OpcodeID opcodeID)
+{
+    Interpreter* interpreter = globalData()->interpreter;
+    Instruction* instructionsBegin = instructions().begin();
+    unsigned instructionCount = instructions().size();
+    
+    for (unsigned bytecodeOffset = 0; bytecodeOffset < instructionCount; ) {
+        switch (interpreter->getOpcodeID(instructionsBegin[bytecodeOffset].u.opcode)) {
+#define DEFINE_OP(curOpcode, length)        \
+        case curOpcode:                     \
+            if (curOpcode == opcodeID)      \
+                return true;                \
+            bytecodeOffset += length;       \
+            break;
+            FOR_EACH_OPCODE_ID(DEFINE_OP)
+#undef DEFINE_OP
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    return false;
+}
+#endif
+
 } // namespace JSC

trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -391 +391 @@
         void discardBytecode() { m_instructions.clear(); }
 
+#ifndef NDEBUG
+        bool usesOpcode(OpcodeID);
+#endif
+
         unsigned instructionCount() { return m_instructionCount; }
         void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }

trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

@@ -223 +223 @@
         hasPrinted = true;
     }
+    if (node.hasConstantBuffer() && codeBlock) {
+        if (hasPrinted)
+            printf(", ");
+        printf("%u:[", node.startConstant());
+        for (unsigned i = 0; i < node.numConstants(); ++i) {
+            if (i)
+                printf(", ");
+            printf("%s", codeBlock->constantBuffer(node.startConstant())[i].description());
+        }
+        printf("]");
+        hasPrinted = true;
+    }
     if (op == JSConstant) {
         printf("%s$%u", hasPrinted ? ", " : "", node.constantNumber());