Changeset 233772 in webkit


Ignore:
Timestamp:
Jul 12, 2018, 10:39:48 AM (6 years ago)
Author:
mark.lam@apple.com
Message:

Need to handle CodeBlock::replacement() being null.
​https://bugs.webkit.org/show_bug.cgi?id=187569
<rdar://problem/41468692>

Reviewed by Saam Barati.

CodeBlock::replacement() may return a nullptr. Some of our code already checks
for this while others do not. We should add null checks in all the places that
need it.

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::hasOptimizedReplacement):
(JSC::CodeBlock::jettison):
(JSC::CodeBlock::numberOfDFGCompiles):
(JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):

  • dfg/DFGOperations.cpp:
  • dfg/DFGToFTLDeferredCompilationCallback.cpp:

(JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
(JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):

  • jit/JITOperations.cpp:
Location:
trunk/Source/JavaScriptCore
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r233765 r233772  
     12018-07-12  Mark Lam  <mark.lam@apple.com>
     2
     3        Need to handle CodeBlock::replacement() being null.
     4        https://bugs.webkit.org/show_bug.cgi?id=187569
     5        <rdar://problem/41468692>
     6
     7        Reviewed by Saam Barati.
     8
     9        CodeBlock::replacement() may return a nullptr.  Some of our code already checks
     10        for this while others do not.  We should add null checks in all the places that
     11        need it.
     12
     13        * bytecode/CodeBlock.cpp:
     14        (JSC::CodeBlock::hasOptimizedReplacement):
     15        (JSC::CodeBlock::jettison):
     16        (JSC::CodeBlock::numberOfDFGCompiles):
     17        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
     18        * dfg/DFGOperations.cpp:
     19        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
     20        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
     21        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
     22        * jit/JITOperations.cpp:
     23
    1242018-07-12  Yusuke Suzuki  <utatane.tea@gmail.com>
    225

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r233765 r233772  
    16571657bool CodeBlock::hasOptimizedReplacement(JITCode::JITType typeToReplace)
    16581658{
    1659     return JITCode::isHigherTier(replacement()->jitType(), typeToReplace);
     1659    CodeBlock* replacement = this->replacement();
     1660    return replacement && JITCode::isHigherTier(replacement->jitType(), typeToReplace);
    16601661}
    16611662
    … …  
    21872188        return (m_hasBeenCompiledWithFTL ? 1 : 0) + m_reoptimizationRetryCounter;
    21882189    }
    2189     return (JITCode::isOptimizingJIT(replacement()->jitType()) ? 1 : 0) + m_reoptimizationRetryCounter;
     2190    CodeBlock* replacement = this->replacement();
     2191    return ((replacement && JITCode::isOptimizingJIT(replacement->jitType())) ? 1 : 0) + m_reoptimizationRetryCounter;
    21902192}
    21912193
    … …  
    24222424    }
    24232425   
    2424     CodeBlock* theReplacement = replacement();
    2425     if ((result == CompilationSuccessful) != (theReplacement != this)) {
     2426    CodeBlock* replacement = this->replacement();
     2427    bool hasReplacement = (replacement && replacement != this);
     2428    if ((result == CompilationSuccessful) != hasReplacement) {
    24262429        dataLog(*this, ": we have result = ", result, " but ");
    2427         if (theReplacement == this)
     2430        if (replacement == this)
    24282431            dataLog("we are our own replacement.\n");
    24292432        else
    2430             dataLog("our replacement is ", pointerDump(theReplacement), "\n");
     2433            dataLog("our replacement is ", pointerDump(replacement), "\n");
    24312434        RELEASE_ASSERT_NOT_REACHED();
    24322435    }
    … …  
    24342437    switch (result) {
    24352438    case CompilationSuccessful:
    2436         RELEASE_ASSERT(JITCode::isOptimizingJIT(replacement()->jitType()));
     2439        RELEASE_ASSERT(replacement && JITCode::isOptimizingJIT(replacement->jitType()));
    24372440        optimizeNextInvocation();
    24382441        return;

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r233722 r233772  
    28642864    // Note that even if optimizedCodeBlock is an FTLForOSREntry style CodeBlock, this condition is a
    28652865    // sure bet that we don't have anything else left to do.
    2866     if (codeBlock->replacement() == codeBlock) {
     2866    CodeBlock* replacement = codeBlock->replacement();
     2867    if (!replacement || replacement == codeBlock) {
    28672868        if (Options::verboseOSR())
    28682869            dataLog(*codeBlock, ": Not reoptimizing because we've already been jettisoned.\n");

  • trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.cpp

    r208063 r233772  
    5151    if (Options::verboseOSR()) {
    5252        dataLog(
    53             "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
     53            "Optimizing compilation of ", codeBlock, " (for ", profiledDFGCodeBlock,
    5454            ") did become ready.\n");
    5555    }
    … …  
    6464    if (Options::verboseOSR()) {
    6565        dataLog(
    66             "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
     66            "Optimizing compilation of ", codeBlock, " (for ", profiledDFGCodeBlock,
    6767            ") result: ", result, "\n");
    6868    }
    … …  
    7171        if (Options::verboseOSR()) {
    7272            dataLog(
    73                 "Dropping FTL code block ", *codeBlock, " on the floor because the "
    74                 "DFG code block ", *profiledDFGCodeBlock, " was jettisoned.\n");
     73                "Dropping FTL code block ", codeBlock, " on the floor because the "
     74                "DFG code block ", profiledDFGCodeBlock, " was jettisoned.\n");
    7575        }
    7676        return;

  • trunk/Source/JavaScriptCore/jit/JITOperations.cpp

    r233630 r233772  
    15381538        }
    15391539    } else if (codeBlock->hasOptimizedReplacement()) {
     1540        CodeBlock* replacement = codeBlock->replacement();
    15401541        if (UNLIKELY(Options::verboseOSR()))
    1541             dataLog("Considering OSR ", *codeBlock, " -> ", *codeBlock->replacement(), ".\n");
     1542            dataLog("Considering OSR ", codeBlock, " -> ", replacement, ".\n");
    15421543        // If we have an optimized replacement, then it must be the case that we entered
    15431544        // cti_optimize from a loop. That's because if there's an optimized replacement,
    … …  
    15531554        // shouldReoptimizeFromLoopNow() to always return true. But we make it do some
    15541555        // additional checking anyway, to reduce the amount of recompilation thrashing.
    1555         if (codeBlock->replacement()->shouldReoptimizeFromLoopNow()) {
     1556        if (replacement->shouldReoptimizeFromLoopNow()) {
    15561557            CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize from loop now"));
    15571558            if (UNLIKELY(Options::verboseOSR())) {
    15581559                dataLog(
    1559                     "Triggering reoptimization of ", *codeBlock,
    1560                     "(", *codeBlock->replacement(), ") (in loop).\n");
     1560                    "Triggering reoptimization of ", codeBlock,
     1561                    "(", replacement, ") (in loop).\n");
    15611562            }
    1562             codeBlock->replacement()->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTrigger, CountReoptimization);
     1563            replacement->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTrigger, CountReoptimization);
    15631564            return encodeResult(0, 0);
    15641565        }
    … …  
    16031604   
    16041605    CodeBlock* optimizedCodeBlock = codeBlock->replacement();
    1605     ASSERT(JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
     1606    ASSERT(optimizedCodeBlock && JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
    16061607   
    16071608    if (void* dataBuffer = DFG::prepareOSREntry(exec, optimizedCodeBlock, bytecodeIndex)) {
    … …  
    16091610        if (UNLIKELY(Options::verboseOSR())) {
    16101611            dataLog(
    1611                 "Performing OSR ", *codeBlock, " -> ", *optimizedCodeBlock, ".\n");
     1612                "Performing OSR ", codeBlock, " -> ", optimizedCodeBlock, ".\n");
    16121613        }
    16131614
    … …  
    16211622    if (UNLIKELY(Options::verboseOSR())) {
    16221623        dataLog(
    1623             "Optimizing ", *codeBlock, " -> ", *codeBlock->replacement(),
     1624            "Optimizing ", codeBlock, " -> ", codeBlock->replacement(),
    16241625            " succeeded, OSR failed, after a delay of ",
    16251626            codeBlock->optimizationDelayCounter(), ".\n");
    … …  
    16421643        if (UNLIKELY(Options::verboseOSR())) {
    16431644            dataLog(
    1644                 "Triggering reoptimization of ", *codeBlock, " -> ",
    1645                 *codeBlock->replacement(), " (after OSR fail).\n");
     1645                "Triggering reoptimization of ", codeBlock, " -> ",
     1646                codeBlock->replacement(), " (after OSR fail).\n");
    16461647        }
    16471648        optimizedCodeBlock->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTriggerOnOSREntryFail, CountReoptimization);
    … …  
    16631664
    16641665    CodeBlock* optimizedReplacement = exec->codeBlock()->replacement();
     1666    if (UNLIKELY(!optimizedReplacement))
     1667        return nullptr;
     1668
    16651669    switch (optimizedReplacement->jitType()) {
    16661670    case JITCode::DFGJIT:
    … …  
    16821686    CodeBlock* codeBlock = exec->codeBlock();
    16831687    CodeBlock* optimizedReplacement = codeBlock->replacement();
     1688    if (UNLIKELY(!optimizedReplacement))
     1689        return nullptr;
    16841690
    16851691    switch (optimizedReplacement->jitType()) {
Note: See TracChangeset for help on using the changeset viewer.