Title: [259576] trunk
- Revision
- 259576
- Author
- [email protected]
- Date
- 2020-04-06 10:35:44 -0700 (Mon, 06 Apr 2020)
Log Message
[JSC] Since ArrayBufferViewWatchpointAdaptor::add can fire watchpoints, DFG::Plan should check validity of CodeBlock after executing reallyAdd
https://bugs.webkit.org/show_bug.cgi?id=210055
<rdar://problem/61331962>
Reviewed by Keith Miller.
JSTests:
* stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js: Added.
(xxx.foo):
Source/_javascript_Core:
Since ArrayBufferViewWatchpointAdaptor::add can fire watchpoints, it is possible that the DFG CodeBlock is already invalidated after executing DFG::Plan::reallyAdd.
We should check CodeBlock's validity again and terminate DFG::Plan::finalizeWithoutNotifyingCallback with CompilationInvalidated if CodeBlock got invalidated.
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (259575 => 259576)
--- trunk/JSTests/ChangeLog 2020-04-06 17:21:02 UTC (rev 259575)
+++ trunk/JSTests/ChangeLog 2020-04-06 17:35:44 UTC (rev 259576)
@@ -1,3 +1,14 @@
+2020-04-06 Yusuke Suzuki <[email protected]>
+
+ [JSC] Since ArrayBufferViewWatchpointAdaptor::add can fire watchpoints, DFG::Plan should check validity of CodeBlock after executing reallyAdd
+ https://bugs.webkit.org/show_bug.cgi?id=210055
+ <rdar://problem/61331962>
+
+ Reviewed by Keith Miller.
+
+ * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js: Added.
+ (xxx.foo):
+
2020-04-05 Ross Kirsling <[email protected]>
JSC shell shouldn't treat NUL as a terminator when printing a JS string
Added: trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js (0 => 259576)
--- trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js (rev 0)
+++ trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js 2020-04-06 17:35:44 UTC (rev 259576)
@@ -0,0 +1,23 @@
+//@ runDefault("--jitPolicyScale=0")
+
+function xxx() {
+ const a = {};
+ Object.defineProperty(a, 0, { get: foo });
+ a.length = 80000000;
+ function foo() {
+ new Uint8Array(a);
+ }
+ new Promise(foo);
+ for (let i = 0; i < 10000000; i++)
+ new ArrayBuffer(1000)
+}
+
+new Int8Array();
+
+try {
+ xxx();
+} catch {}
+
+let arr1 = new Uint8Array(9);
+arr1[0] = 0;
+for (let i = 0; i < 1000000; ++i) {}
Modified: trunk/Source/_javascript_Core/ChangeLog (259575 => 259576)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-06 17:21:02 UTC (rev 259575)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-06 17:35:44 UTC (rev 259576)
@@ -1,5 +1,19 @@
2020-04-06 Yusuke Suzuki <[email protected]>
+ [JSC] Since ArrayBufferViewWatchpointAdaptor::add can fire watchpoints, DFG::Plan should check validity of CodeBlock after executing reallyAdd
+ https://bugs.webkit.org/show_bug.cgi?id=210055
+ <rdar://problem/61331962>
+
+ Reviewed by Keith Miller.
+
+ Since ArrayBufferViewWatchpointAdaptor::add can fire watchpoints, it is possible that the DFG CodeBlock is already invalidated after executing DFG::Plan::reallyAdd.
+ We should check CodeBlock's validity again and terminate DFG::Plan::finalizeWithoutNotifyingCallback with CompilationInvalidated if CodeBlock got invalidated.
+
+ * dfg/DFGPlan.cpp:
+ (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+
+2020-04-06 Yusuke Suzuki <[email protected]>
+
[JSC] Put ensureStillAliveHere for Integer TypedArrays in GetByVal
https://bugs.webkit.org/show_bug.cgi?id=210047
Modified: trunk/Source/_javascript_Core/dfg/DFGPlan.cpp (259575 => 259576)
--- trunk/Source/_javascript_Core/dfg/DFGPlan.cpp 2020-04-06 17:21:02 UTC (rev 259575)
+++ trunk/Source/_javascript_Core/dfg/DFGPlan.cpp 2020-04-06 17:35:44 UTC (rev 259576)
@@ -627,6 +627,12 @@
m_codeBlock->shrinkToFit(locker, CodeBlock::ShrinkMode::LateShrink);
}
+ // Since Plan::reallyAdd could fire watchpoints (see ArrayBufferViewWatchpointAdaptor::add), it is possible that the current CodeBlock is now invalidated.
+ if (!m_codeBlock->jitCode()->dfgCommon()->isStillValid) {
+ CODEBLOCK_LOG_EVENT(m_codeBlock, "dfgFinalize", ("invalidated"));
+ return CompilationInvalidated;
+ }
+
if (validationEnabled()) {
TrackedReferences trackedReferences;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
