Changeset 146268 in webkit for trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp

Timestamp:

Mar 19, 2013, 3:22:06 PM (12 years ago)

Author:

[email protected]

Message:

Crash when loading ​http://www.jqchart.com/jquery/gauges/RadialGauge/LiveData
​https://bugs.webkit.org/show_bug.cgi?id=112694

Reviewed by Filip Pizlo.

We were trying to convert an NewArray to a Phantom, but convertToPhantom doesn't handle
nodes with variable arguments. Added code to insert a Phantom node in front of all the
live children of a var args node. Added ASSERT not var args for convertToPhantom to
catch any other similar cases. Added a new convertToPhantomUnchecked() for converting
var arg nodes.

• dfg/DFGDCEPhase.cpp:

(JSC::DFG::DCEPhase::run):

• dfg/DFGNode.h:

(Node):
(JSC::DFG::Node::setOpAndDefaultNonExitFlags): Added ASSERT(!(m_flags & NodeHasVarArgs))
(JSC::DFG::Node::setOpAndDefaultNonExitFlagsUnchecked):
(JSC::DFG::Node::convertToPhantomUnchecked):

File:

• trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp

@@ -31 +31 @@
 #include "DFGBasicBlockInlines.h"
 #include "DFGGraph.h"
+#include "DFGInsertionSet.h"
 #include "DFGPhase.h"
 #include "Operations.h"
@@ -85 +86 @@
             if (!block)
                 continue;
+
+            InsertionSet insertionSet(m_graph);
+
             for (unsigned indexInBlock = block->size(); indexInBlock--;) {
                 Node* node = block->at(indexInBlock);
@@ -117 +121 @@
                     break;
                 }
-                    
+
                 default: {
+                    if (node->flags() & NodeHasVarArgs) {
+                        for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
+                            Edge edge = m_graph.m_varArgChildren[childIdx];
+
+                            if (!edge || edge.isProved() || edge.useKind() == UntypedUse)
+                                continue;
+
+                            insertionSet.insertNode(indexInBlock, SpecNone, Phantom, node->codeOrigin, edge);
+                        }
+
+                        node->convertToPhantomUnchecked();
+                        node->children.reset();
+                        node->setRefCount(1);
+                        break;
+                    }
+
                     node->convertToPhantom();
                     eliminateIrrelevantPhantomChildren(node);
@@ -125 +145 @@
                 } }
             }
+
+            insertionSet.execute(block);
         }