Attachment 349802 Details for Bug 189628 – patch for landing

[patch] patch for landing

c-backup.diff (text/plain), 3.81 KB, created by Saam Barati on 2018-09-14 14:00:28 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2018-09-14 14:00:28 PDT

Size: 3.81 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 236017)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2018-09-14  Saam barati  <sbarati@apple.com>
>+
>+        Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
>+        https://bugs.webkit.org/show_bug.cgi?id=189628
>+        <rdar://problem/39481690>
>+
>+        Reviewed by Mark Lam.
>+
>+        * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
>+        (foo):
>+
> 2018-09-11  Mark Lam  <mark.lam@apple.com>
> 
>         Test for array initialization in arrayProtoFuncSplice.
>Index: JSTests/stress/verbose-failure-dont-graph-dump-availability-already-freed.js
>===================================================================
>--- JSTests/stress/verbose-failure-dont-graph-dump-availability-already-freed.js	(nonexistent)
>+++ JSTests/stress/verbose-failure-dont-graph-dump-availability-already-freed.js	(working copy)
>@@ -0,0 +1,9 @@
>+//@ runDefault("--verboseValidationFailure=true")
>+
>+function foo() {
>+    arguments.length;
>+}
>+let a = 0;
>+for (var i = 0; i < 1000000; i++) {
>+    a += foo();
>+}
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 236015)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,20 @@
>+2018-09-14  Saam barati  <sbarati@apple.com>
>+
>+        Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
>+        https://bugs.webkit.org/show_bug.cgi?id=189628
>+        <rdar://problem/39481690>
>+
>+        Reviewed by Mark Lam.
>+
>+        An Availability may point to a Node. And that Node may be removed from
>+        the graph, e.g, it's freed and its memory is no longer owned by Graph.
>+        This patch makes it so we no longer dump this metadata by default. If
>+        this metadata is interesting to you, you'll need to go in and change
>+        Graph::dump to dump the needed metadata.
>+
>+        * dfg/DFGGraph.cpp:
>+        (JSC::DFG::Graph::dump):
>+
> 2018-09-14  Devin Rousso  <webkit@devinrousso.com>
> 
>         Web Inspector: Record actions performed on ImageBitmapRenderingContext
>Index: Source/JavaScriptCore/dfg/DFGGraph.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGGraph.cpp	(revision 236015)
>+++ Source/JavaScriptCore/dfg/DFGGraph.cpp	(working copy)
>@@ -60,6 +60,8 @@
> 
> namespace JSC { namespace DFG {
> 
>+static constexpr bool dumpOSRAvailabilityData = false;
>+
> // Creates an array of stringized names.
> static const char* dfgOpNames[] = {
> #define STRINGIZE_DFG_OP_ENUM(opcode, flags) #opcode ,
>@@ -569,7 +571,8 @@ void Graph::dump(PrintStream& out, DumpC
>             
>         case SSA: {
>             RELEASE_ASSERT(block->ssa);
>-            out.print("  Availability: ", block->ssa->availabilityAtHead, "\n");
>+            if (dumpOSRAvailabilityData)
>+                out.print("  Availability: ", block->ssa->availabilityAtHead, "\n");
>             out.print("  Live: ", nodeListDump(block->ssa->liveAtHead), "\n");
>             out.print("  Values: ", nodeValuePairListDump(block->ssa->valuesAtHead, context), "\n");
>             break;
>@@ -597,7 +600,8 @@ void Graph::dump(PrintStream& out, DumpC
>             
>         case SSA: {
>             RELEASE_ASSERT(block->ssa);
>-            out.print("  Availability: ", block->ssa->availabilityAtTail, "\n");
>+            if (dumpOSRAvailabilityData)
>+                out.print("  Availability: ", block->ssa->availabilityAtTail, "\n");
>             out.print("  Live: ", nodeListDump(block->ssa->liveAtTail), "\n");
>             out.print("  Values: ", nodeValuePairListDump(block->ssa->valuesAtTail, context), "\n");
>             break;

Actions: View | Formatted Diff | Diff

Attachments on bug 189628: 349801 | 349802