Changeset 193491 in webkit for trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

Timestamp:

Dec 4, 2015, 5:04:20 PM (10 years ago)

Author:

[email protected]

Message:

CRASH: CodeBlock::setOptimizationThresholdBasedOnCompilationResult + 567
​https://bugs.webkit.org/show_bug.cgi?id=151892

Reviewed by Mark Lam.

When the debugger is in the process of attaching and it recompiles functions
for debugging, there can also be a DFG compilation running concurrently.
When we go to update the optimization threshold and find that the replacement
is also baseline code, we shouldn't update the threshold.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):

File:

• trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -3706 +3706 @@
     
     CodeBlock* theReplacement = replacement();
+
+    // If our replacement is baseline code, the debugger has probably attached and recompiled the function.
+    // No threshold to change.
+    if ((result == CompilationSuccessful) && (theReplacement->jitType() == JITCode::BaselineJIT))
+        return;
+
     if ((result == CompilationSuccessful) != (theReplacement != this)) {
         dataLog(*this, ": we have result = ", result, " but ");