Changeset 272766 in webkit

Timestamp:

Feb 11, 2021, 6:14:03 PM (4 years ago)

Author:

mark.lam@apple.com

Message:

CodeBlock::propagateTransitions() should also handle OpSetPrivateBrand's LLInt IC.
​https://bugs.webkit.org/show_bug.cgi?id=221787

Reviewed by Yusuke Suzuki.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::propagateTransitions):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-02-11  Mark Lam  <mark.lam@apple.com>
+
+        CodeBlock::propagateTransitions() should also handle OpSetPrivateBrand's LLInt IC.
+        https://bugs.webkit.org/show_bug.cgi?id=221787
+
+        Reviewed by Yusuke Suzuki.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::propagateTransitions):
+
 2021-02-11  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2008-2020 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2021 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
  *
@@ -1134 +1134 @@
                 if (!oldStructureID || !newStructureID)
                     return;
-                Structure* oldStructure =
-                    vm.heap.structureIDTable().get(oldStructureID);
-                Structure* newStructure =
-                    vm.heap.structureIDTable().get(newStructureID);
-                if (vm.heap.isMarked(oldStructure))
+                Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
+                if (vm.heap.isMarked(oldStructure)) {
+                    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
                     visitor.appendUnbarriered(newStructure);
+                }
             });
 
@@ -1153 +1152 @@
                     return;
 
-                Structure* oldStructure =
-                    vm.heap.structureIDTable().get(oldStructureID);
-                Structure* newStructure =
-                    vm.heap.structureIDTable().get(newStructureID);
-                if (vm.heap.isMarked(oldStructure))
+                Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
+                if (vm.heap.isMarked(oldStructure)) {
+                    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
                     visitor.appendUnbarriered(newStructure);
+                }
+            });
+
+            m_metadata->forEach<OpSetPrivateBrand>([&] (auto& metadata) {
+                StructureID oldStructureID = metadata.m_oldStructureID;
+                StructureID newStructureID = metadata.m_newStructureID;
+                if (!oldStructureID || !newStructureID)
+                    return;
+
+                JSCell* brand = metadata.m_brand.get();
+                ASSERT(brand);
+                if (!vm.heap.isMarked(brand))
+                    return;
+
+                Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
+                if (vm.heap.isMarked(oldStructure)) {
+                    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
+                    visitor.appendUnbarriered(newStructure);
+                }
             });
         }