Changeset 190827 in webkit for trunk/Source/JavaScriptCore/dfg/DFGGraph.h

Timestamp:

Oct 9, 2015, 4:10:16 PM (10 years ago)

Author:

[email protected]

Message:

2015-10-09 Geoffrey Garen <​[email protected]>

Unreviewed, rolling back in r190694
​https://bugs.webkit.org/show_bug.cgi?id=149727

This time for double sure?

The cause of the crash was an incorrect write barrier.

OSR exit was barriering the baseline codeblock for the top of the stack
twice, missing the baseline codeblock for the bottom of the stack.

Restored changesets:

"CodeBlock should be a GC object"
​https://bugs.webkit.org/show_bug.cgi?id=149727
​http://trac.webkit.org/changeset/r190694

File:

• trunk/Source/JavaScriptCore/dfg/DFGGraph.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGGraph.h

@@ -349 +349 @@
             return m_codeBlock->ownerScriptExecutable();
         
-        return inlineCallFrame->executable.get();
+        return inlineCallFrame->baselineCodeBlock->ownerScriptExecutable();
     }
     
@@ -373 +373 @@
         if (!codeOrigin.inlineCallFrame)
             return m_codeBlock->isStrictMode();
-        return jsCast<FunctionExecutable*>(codeOrigin.inlineCallFrame->executable.get())->isStrictMode();
+        return codeOrigin.inlineCallFrame->isStrictMode();
     }