Changeset 224217 in webkit

Timestamp:

Oct 30, 2017 6:15:08 PM (6 years ago)

Author:

sbarati@apple.com

Message:

We need a storeStoreFence before storing to the instruction stream's live variable catch data
​https://bugs.webkit.org/show_bug.cgi?id=178649

Reviewed by Keith Miller.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeOffsetSlow):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-10-30  Saam Barati  <sbarati@apple.com>
+
+        We need a storeStoreFence before storing to the instruction stream's live variable catch data
+        https://bugs.webkit.org/show_bug.cgi?id=178649
+
+        Reviewed by Keith Miller.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeOffsetSlow):
+
 2017-10-30  Michael Catanzaro  <mcatanzaro@igalia.com>
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1743 +1743 @@
     for (unsigned i = 0; i < profiles->m_size; ++i)
         profiles->m_buffer.get()[i].m_operand = liveOperands[i].offset();
+
+    // The compiler thread will read this pointer value and then proceed to dereference it
+    // if it is not null. We need to make sure all above stores happen before this store so
+    // the compiler thread reads fully initialized data.
+    WTF::storeStoreFence(); 
+
     m_instructions[bytecodeOffset + 3].u.pointer = profiles.get();