Changeset 169973 in webkit for trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

Timestamp:

Jun 14, 2014, 10:43:32 AM (11 years ago)

Author:

[email protected]

Message:

operationCreateArguments could cause a GC during OSR exit
​https://bugs.webkit.org/show_bug.cgi?id=133905

Reviewed by Filip Pizlo.

Defer GC via new wrapper functions for operationCreateArguments and operationCreateInlinedArguments
for use by OSR exit stubs.

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::ArgumentsRecoveryGenerator::generateFor):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• jit/JITOperations.cpp:
• jit/JITOperations.h:

File:

• trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -770 +770 @@
 }
 
+JSCell* JIT_OPERATION operationCreateInlinedArgumentsDuringOSRExit(ExecState* exec, InlineCallFrame* inlineCallFrame)
+{
+    DeferGCForAWhile(exec->vm().heap);
+    return operationCreateInlinedArguments(exec, inlineCallFrame);
+}
+
 void JIT_OPERATION operationTearOffInlinedArguments(
     ExecState* exec, JSCell* argumentsCell, JSCell* activationCell, InlineCallFrame* inlineCallFrame)