Changeset 90875 in webkit


Ignore:
Timestamp:
Jul 12, 2011 5:53:17 PM (13 years ago)
Author:
oliver@apple.com
Message:

Overzealous type validation in method_check
​https://bugs.webkit.org/show_bug.cgi?id=64415

Reviewed by Gavin Barraclough.

../../../../Volumes/Data/git/WebKit/OpenSource/LayoutTests:

Make sure we don't trip any assertions when caching access
to an InternalFunction

  • fast/js/script-tests/method-check.js:

../../../../Volumes/Data/git/WebKit/OpenSource/Source/JavaScriptCore:

method_check is essentially just a value look up
optimisation, but it internally stores the value
as a JSFunction, even though it never relies on
this fact. Under GC validation however we end up
trying to enforce that assumption. The fix is
simply to store the value as a correct supertype.

  • bytecode/CodeBlock.h:
  • dfg/DFGRepatch.cpp:

(JSC::DFG::dfgRepatchGetMethodFast):
(JSC::DFG::tryCacheGetMethod):

  • jit/JIT.h:
  • jit/JITPropertyAccess.cpp:

(JSC::JIT::patchMethodCallProto):

  • jit/JITStubs.cpp:

(JSC::DEFINE_STUB_FUNCTION):

Location:
trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r90870 r90875  
     12011-07-12  Oliver Hunt  <oliver@apple.com>
     2
     3        Overzealous type validation in method_check
     4        https://bugs.webkit.org/show_bug.cgi?id=64415
     5
     6        Reviewed by Gavin Barraclough.
     7
     8        Make sure we don't trip any assertions when caching access
     9        to an InternalFunction
     10
     11        * fast/js/script-tests/method-check.js:
     12
    1132011-07-12  Joseph Pecoraro  <joepeck@webkit.org>
    214

  • trunk/LayoutTests/fast/js/script-tests/method-check.js

    r55379 r90875  
    5454shouldBe('total', '200');
    5555
     56// Check that we don't assert when method_check is applied to a non-JSFunction
     57for (var i = 0; i < 10000; i++)
     58    Array.constructor(1);
     59
    5660var successfullyParsed = true;

  • trunk/Source/JavaScriptCore/ChangeLog

    r90865 r90875  
     12011-07-12  Oliver Hunt  <oliver@apple.com>
     2
     3        Overzealous type validation in method_check
     4        https://bugs.webkit.org/show_bug.cgi?id=64415
     5
     6        Reviewed by Gavin Barraclough.
     7
     8        method_check is essentially just a value look up
     9        optimisation, but it internally stores the value
     10        as a JSFunction, even though it never relies on
     11        this fact.  Under GC validation however we end up
     12        trying to enforce that assumption.  The fix is
     13        simply to store the value as a correct supertype.
     14
     15        * bytecode/CodeBlock.h:
     16        * dfg/DFGRepatch.cpp:
     17        (JSC::DFG::dfgRepatchGetMethodFast):
     18        (JSC::DFG::tryCacheGetMethod):
     19        * jit/JIT.h:
     20        * jit/JITPropertyAccess.cpp:
     21        (JSC::JIT::patchMethodCallProto):
     22        * jit/JITStubs.cpp:
     23        (JSC::DEFINE_STUB_FUNCTION):
     24
    1252011-07-12  Filip Pizlo  <fpizlo@apple.com>
    226

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

    r90529 r90875  
    147147        JITWriteBarrier<Structure> cachedStructure;
    148148        JITWriteBarrier<Structure> cachedPrototypeStructure;
    149         JITWriteBarrier<JSFunction> cachedFunction;
     149        // We'd like this to actually be JSFunction, but InternalFunction and JSFunction
     150        // don't have a common parent class and we allow specialisation on both
     151        JITWriteBarrier<JSObjectWithGlobalObject> cachedFunction;
    150152        JITWriteBarrier<JSObject> cachedPrototype;
    151153        bool seen;

  • trunk/Source/JavaScriptCore/dfg/DFGRepatch.cpp

    r90854 r90875  
    162162}
    163163
    164 static void dfgRepatchGetMethodFast(JSGlobalData* globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodInfo, JSFunction* callee, Structure* structure, JSObject* slotBaseObject)
     164static void dfgRepatchGetMethodFast(JSGlobalData* globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodInfo, JSObjectWithGlobalObject* callee, Structure* structure, JSObject* slotBaseObject)
    165165{
    166166    ScriptExecutable* owner = codeBlock->ownerExecutable();
    … …  
    191191        && specific) {
    192192       
    193         JSFunction* callee = (JSFunction*)specific;
     193        JSObjectWithGlobalObject* callee = (JSObjectWithGlobalObject*)specific;
    194194       
    195195        // Since we're accessing a prototype in a loop, it's a good bet that it

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r90414 r90875  
    239239        static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
    240240        static void patchPutByIdReplace(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress, bool direct);
    241         static void patchMethodCallProto(JSGlobalData&, CodeBlock* codeblock, MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*, ReturnAddressPtr);
     241        static void patchMethodCallProto(JSGlobalData&, CodeBlock* codeblock, MethodCallLinkInfo&, JSObjectWithGlobalObject*, Structure*, JSObject*, ReturnAddressPtr);
    242242
    243243        static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r90193 r90875  
    10371037}
    10381038
    1039 void JIT::patchMethodCallProto(JSGlobalData& globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
     1039void JIT::patchMethodCallProto(JSGlobalData& globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSObjectWithGlobalObject* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
    10401040{
    10411041    RepatchBuffer repatchBuffer(codeBlock);

  • trunk/Source/JavaScriptCore/jit/JITStubs.cpp

    r90414 r90875  
    15301530        ) {
    15311531
    1532         JSFunction* callee = (JSFunction*)specific;
     1532        JSObjectWithGlobalObject* callee = (JSObjectWithGlobalObject*)specific;
    15331533
    15341534        // Since we're accessing a prototype in a loop, it's a good bet that it
Note: See TracChangeset for help on using the changeset viewer.