Changeset 104086 in webkit for trunk/Source/JavaScriptCore/dfg/DFGNode.h

Timestamp:

Jan 4, 2012, 3:13:30 PM (13 years ago)

Author:

[email protected]

Message:

Incorrect use of DFG node reference counts when mutating the graph
​https://bugs.webkit.org/show_bug.cgi?id=75580
<rdar://problem/10644607>

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

Made deref(node) follow the pattern of ref(node), which it should have
to begin with.

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::refChildren):
(JSC::DFG::Graph::derefChildren):

• dfg/DFGGraph.h:

(JSC::DFG::Graph::deref):
(JSC::DFG::Graph::clearAndDerefChild1):
(JSC::DFG::Graph::clearAndDerefChild2):
(JSC::DFG::Graph::clearAndDerefChild3):

• dfg/DFGNode.h:

(JSC::DFG::Node::deref):

• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::fixupNode):

LayoutTests:

Reviewed by Oliver Hunt.

• fast/js/dfg-array-length-dead-expected.txt: Added.
• fast/js/dfg-array-length-dead.html: Added.
• fast/js/script-tests/dfg-array-length-dead.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGNode.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -837 +837 @@
     }
     
-    void deref()
-    {
-        m_refCount--;
+    // Derefs the node and returns true if the ref count reached zero.
+    // In general you don't want to use this directly; use Graph::deref
+    // instead.
+    bool deref()
+    {
+        ASSERT(m_refCount);
+        return !--m_refCount;
     }