Changeset 253994 in webkit for trunk/Source/JavaScriptCore/b3/B3ReduceLoopStrength.cpp

Timestamp:

Jan 3, 2020, 2:06:49 AM (5 years ago)

Author:

[email protected]

Message:

B3::ReduceLoopStrength should not do range based iteration on a vector it's mutating
​https://bugs.webkit.org/show_bug.cgi?id=205703
<rdar://problem/56459483>

Reviewed by Mark Lam.

JSTests:

• stress/dont-range-based-iterate-vector-that-is-mutated.js: Added.

(foo):

Source/JavaScriptCore:

B3::ReduceLoopStrength had code that did:
`
for (BasicBlock* pred : loopPostfooter->predecessors())

loopPostfooter->removePredecessor(pred);

`

This is wrong, since it's doing a range based iteration over the vector it is
mutating. The fix is to just do:
`
while (loopPostfooter->predecessors().size())

loopPostfooter->removePredecessor(loopPostfooter->predecessors()[0]);

`

• b3/B3ReduceLoopStrength.cpp:

(JSC::B3::ReduceLoopStrength::reduceByteCopyLoopsToMemcpy):

File:

• trunk/Source/JavaScriptCore/b3/B3ReduceLoopStrength.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/b3/B3ReduceLoopStrength.cpp

@@ -438 +438 @@
         memcpy->setSuccessors(FrequentedBlock(loopPostfooter));
         memcpy->addPredecessor(loopPreheader);
-        for (BasicBlock* pred : loopPostfooter->predecessors())
-            loopPostfooter->removePredecessor(pred);
+        while (loopPostfooter->predecessors().size()) 
+            loopPostfooter->removePredecessor(loopPostfooter->predecessors()[0]);
         loopPostfooter->addPredecessor(memcpy);
         loopPreheader->setSuccessors(memcpy);