Changeset 190522 in webkit for trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h

Timestamp:

Oct 2, 2015, 2:16:20 PM (10 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling back in r190450
​https://bugs.webkit.org/show_bug.cgi?id=149727

The cause of the crash was a CodeBlock, after surviving a call to
deleteAllCode by virtue of being in the remembered set, trying to mark
its inlined CodeBlocks via pointers from its inlined executables.
Since deleteAllCode clears those pointers, the CodeBlock would ASSERT.
(Any other choice to retain a CodeBlock after deleteAllCode -- for
example, conservative marking -- could trigger the same bug.)

The fix is for InlineCallFrame to point directly to its inlined CodeBlock
instead of pointing indirectly via an executable. This guarantees that
CodeBlocks are GC safe regardless of whether we've called deleteAllCode.

Restored changesets:

"CodeBlock should be a GC object"
​https://bugs.webkit.org/show_bug.cgi?id=149727
​http://trac.webkit.org/changeset/190450

File:

• trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h (modified) (6 diffs)

trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h

@@ -30 +30 @@
 #include "CodeBlockHash.h"
 #include "CodeOrigin.h"
-#include "Executable.h"
 #include "ValueRecovery.h"
 #include "WriteBarrier.h"
@@ -43 +42 @@
 struct InlineCallFrame;
 class ExecState;
-class ScriptExecutable;
 class JSFunction;
 
@@ -175 +173 @@
     
     Vector<ValueRecovery> arguments; // Includes 'this'.
-    WriteBarrier<ScriptExecutable> executable;
+    WriteBarrier<CodeBlock> baselineCodeBlock;
     ValueRecovery calleeRecovery;
     CodeOrigin directCaller;
@@ -210 +208 @@
     CString hashAsStringIfPossible() const;
     
-    CodeBlock* baselineCodeBlock() const;
-    
     void setStackOffset(signed offset)
     {
@@ -220 +216 @@
     ptrdiff_t callerFrameOffset() const { return stackOffset * sizeof(Register) + CallFrame::callerFrameOffset(); }
     ptrdiff_t returnPCOffset() const { return stackOffset * sizeof(Register) + CallFrame::returnPCOffset(); }
+
+    bool isStrictMode() const { return baselineCodeBlock->isStrictMode(); }
 
     void dumpBriefFunctionInformation(PrintStream&) const;
@@ -232 +230 @@
 {
     RELEASE_ASSERT(inlineCallFrame);
-    ScriptExecutable* executable = inlineCallFrame->executable.get();
-    RELEASE_ASSERT(executable->structure()->classInfo() == FunctionExecutable::info());
-    return static_cast<FunctionExecutable*>(executable)->baselineCodeBlockFor(inlineCallFrame->specializationKind());
+    return inlineCallFrame->baselineCodeBlock.get();
 }