Changeset 183307 in webkit for trunk/Source/JavaScriptCore/dfg/DFGGenerationInfo.h

Timestamp:

Apr 24, 2015, 10:19:07 PM (10 years ago)

Author:

[email protected]

Message:

CRASH in operationCreateDirectArgumentsDuringExit()
​https://bugs.webkit.org/show_bug.cgi?id=143962

Reviewed by Geoffrey Garen.

We shouldn't assume that constant-like OSR exit values are always recoverable. They are only
recoverable so long as they are live. Therefore, OSR exit should track liveness of
constants instead of assuming that they are always live.

• dfg/DFGGenerationInfo.h:

(JSC::DFG::GenerationInfo::noticeOSRBirth):
(JSC::DFG::GenerationInfo::appendBirth):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCurrentBlock):

• dfg/DFGVariableEvent.cpp:

(JSC::DFG::VariableEvent::dump):

• dfg/DFGVariableEvent.h:

(JSC::DFG::VariableEvent::birth):
(JSC::DFG::VariableEvent::id):
(JSC::DFG::VariableEvent::dataFormat):

• dfg/DFGVariableEventStream.cpp:

(JSC::DFG::VariableEventStream::reconstruct):

• tests/stress/phantom-direct-arguments-clobber-argument-count.js: Added.

(foo):
(bar):

• tests/stress/phantom-direct-arguments-clobber-callee.js: Added.

(foo):
(bar):

File:

• trunk/Source/JavaScriptCore/dfg/DFGGenerationInfo.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGGenerationInfo.h

@@ -154 +154 @@
     void noticeOSRBirth(VariableEventStream& stream, Node* node, VirtualRegister virtualRegister)
     {
-        if (m_isConstant)
-            return;
         if (m_node != node)
             return;
@@ -165 +163 @@
         m_bornForOSR = true;
         
-        if (m_registerFormat != DataFormatNone)
+        if (m_isConstant)
+            appendBirth(stream);
+        else if (m_registerFormat != DataFormatNone)
             appendFill(BirthToFill, stream);
         else if (m_spillFormat != DataFormatNone)
@@ -380 +380 @@
 
 private:
+    void appendBirth(VariableEventStream& stream)
+    {
+        stream.appendAndLog(VariableEvent::birth(MinifiedID(m_node)));
+    }
+    
     void appendFill(VariableEventKind kind, VariableEventStream& stream)
     {