Changeset 87190 in webkit

Timestamp:

May 24, 2011 12:39:47 PM (13 years ago)

Author:

oliver@apple.com

Message:

2011-05-24 Oliver Hunt <​oliver@apple.com>

Reviewed by Gavin Barraclough.

Interpreter crashes with gc validation enabled due to failure to mark initial cache structure
​https://bugs.webkit.org/show_bug.cgi?id=61385

The interpreter uses the structure slot of get_by_id and put_by_id to hold
the initial structure it encountered so that it can identify whether a
given access is stable.

When marking though we only visit the slot when we've decided to cache, and
so this value could die. This was "safe" as the value was only used for a
pointer compare, but it was incorrect. We now just mark the slot like we
should have been doing already.

• bytecode/CodeBlock.cpp: (JSC::CodeBlock::visitStructures):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-05-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Interpreter crashes with gc validation enabled due to failure to mark initial cache structure
+        https://bugs.webkit.org/show_bug.cgi?id=61385
+
+        The interpreter uses the structure slot of get_by_id and put_by_id to hold
+        the initial structure it encountered so that it can identify whether a
+        given access is stable.
+
+        When marking though we only visit the slot when we've decided to cache, and
+        so this value could die.  This was "safe" as the value was only used for a
+        pointer compare, but it was incorrect.  We now just mark the slot like we
+        should have been doing already.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitStructures):
+
 2011-05-24  Adam Roben  <aroben@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1406 +1406 @@
     Interpreter* interpreter = m_globalData->interpreter;
 
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) && vPC[4].u.structure) {
+        visitor.append(&vPC[4].u.structure);
+        return;
+    }
+
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
         visitor.append(&vPC[4].u.structure);
@@ -1424 +1429 @@
         visitor.append(&vPC[5].u.structure);
         visitor.append(&vPC[6].u.structureChain);
+        return;
+    }
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) && vPC[4].u.structure) {
+        visitor.append(&vPC[4].u.structure);
         return;
     }