Title: [233772] trunk/Source/_javascript_Core
Revision
233772
Author
[email protected]
Date
2018-07-12 10:39:48 -0700 (Thu, 12 Jul 2018)

Log Message

Need to handle CodeBlock::replacement() being null.
https://bugs.webkit.org/show_bug.cgi?id=187569
<rdar://problem/41468692>

Reviewed by Saam Barati.

CodeBlock::replacement() may return a nullptr.  Some of our code already checks
for this while others do not.  We should add null checks in all the places that
need it.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::hasOptimizedReplacement):
(JSC::CodeBlock::jettison):
(JSC::CodeBlock::numberOfDFGCompiles):
(JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
* dfg/DFGOperations.cpp:
* dfg/DFGToFTLDeferredCompilationCallback.cpp:
(JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
(JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
* jit/JITOperations.cpp:

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (233771 => 233772)


--- trunk/Source/_javascript_Core/ChangeLog	2018-07-12 17:03:41 UTC (rev 233771)
+++ trunk/Source/_javascript_Core/ChangeLog	2018-07-12 17:39:48 UTC (rev 233772)
@@ -1,3 +1,26 @@
+2018-07-12  Mark Lam  <[email protected]>
+
+        Need to handle CodeBlock::replacement() being null.
+        https://bugs.webkit.org/show_bug.cgi?id=187569
+        <rdar://problem/41468692>
+
+        Reviewed by Saam Barati.
+
+        CodeBlock::replacement() may return a nullptr.  Some of our code already checks
+        for this while others do not.  We should add null checks in all the places that
+        need it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::jettison):
+        (JSC::CodeBlock::numberOfDFGCompiles):
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
+        * jit/JITOperations.cpp:
+
 2018-07-12  Yusuke Suzuki  <[email protected]>
 
         [JSC] Thread VM& to JSCell::methodTable(VM&)

Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp (233771 => 233772)


--- trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp	2018-07-12 17:03:41 UTC (rev 233771)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp	2018-07-12 17:39:48 UTC (rev 233772)
@@ -1656,7 +1656,8 @@
 #if ENABLE(JIT)
 bool CodeBlock::hasOptimizedReplacement(JITCode::JITType typeToReplace)
 {
-    return JITCode::isHigherTier(replacement()->jitType(), typeToReplace);
+    CodeBlock* replacement = this->replacement();
+    return replacement && JITCode::isHigherTier(replacement->jitType(), typeToReplace);
 }
 
 bool CodeBlock::hasOptimizedReplacement()
@@ -2186,7 +2187,8 @@
             return 1000000;
         return (m_hasBeenCompiledWithFTL ? 1 : 0) + m_reoptimizationRetryCounter;
     }
-    return (JITCode::isOptimizingJIT(replacement()->jitType()) ? 1 : 0) + m_reoptimizationRetryCounter;
+    CodeBlock* replacement = this->replacement();
+    return ((replacement && JITCode::isOptimizingJIT(replacement->jitType())) ? 1 : 0) + m_reoptimizationRetryCounter;
 }
 
 int32_t CodeBlock::codeTypeThresholdMultiplier() const
@@ -2421,19 +2423,20 @@
         RELEASE_ASSERT_NOT_REACHED();
     }
     
-    CodeBlock* theReplacement = replacement();
-    if ((result == CompilationSuccessful) != (theReplacement != this)) {
+    CodeBlock* replacement = this->replacement();
+    bool hasReplacement = (replacement && replacement != this);
+    if ((result == CompilationSuccessful) != hasReplacement) {
         dataLog(*this, ": we have result = ", result, " but ");
-        if (theReplacement == this)
+        if (replacement == this)
             dataLog("we are our own replacement.\n");
         else
-            dataLog("our replacement is ", pointerDump(theReplacement), "\n");
+            dataLog("our replacement is ", pointerDump(replacement), "\n");
         RELEASE_ASSERT_NOT_REACHED();
     }
     
     switch (result) {
     case CompilationSuccessful:
-        RELEASE_ASSERT(JITCode::isOptimizingJIT(replacement()->jitType()));
+        RELEASE_ASSERT(replacement && JITCode::isOptimizingJIT(replacement->jitType()));
         optimizeNextInvocation();
         return;
     case CompilationFailed:

Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.cpp (233771 => 233772)


--- trunk/Source/_javascript_Core/dfg/DFGOperations.cpp	2018-07-12 17:03:41 UTC (rev 233771)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.cpp	2018-07-12 17:39:48 UTC (rev 233772)
@@ -2863,7 +2863,8 @@
     //
     // Note that even if optimizedCodeBlock is an FTLForOSREntry style CodeBlock, this condition is a
     // sure bet that we don't have anything else left to do.
-    if (codeBlock->replacement() == codeBlock) {
+    CodeBlock* replacement = codeBlock->replacement();
+    if (!replacement || replacement == codeBlock) {
         if (Options::verboseOSR())
             dataLog(*codeBlock, ": Not reoptimizing because we've already been jettisoned.\n");
         return;

Modified: trunk/Source/_javascript_Core/dfg/DFGToFTLDeferredCompilationCallback.cpp (233771 => 233772)


--- trunk/Source/_javascript_Core/dfg/DFGToFTLDeferredCompilationCallback.cpp	2018-07-12 17:03:41 UTC (rev 233771)
+++ trunk/Source/_javascript_Core/dfg/DFGToFTLDeferredCompilationCallback.cpp	2018-07-12 17:39:48 UTC (rev 233772)
@@ -50,7 +50,7 @@
 {
     if (Options::verboseOSR()) {
         dataLog(
-            "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
+            "Optimizing compilation of ", codeBlock, " (for ", profiledDFGCodeBlock,
             ") did become ready.\n");
     }
     
@@ -63,7 +63,7 @@
 {
     if (Options::verboseOSR()) {
         dataLog(
-            "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
+            "Optimizing compilation of ", codeBlock, " (for ", profiledDFGCodeBlock,
             ") result: ", result, "\n");
     }
     
@@ -70,8 +70,8 @@
     if (profiledDFGCodeBlock->replacement() != profiledDFGCodeBlock) {
         if (Options::verboseOSR()) {
             dataLog(
-                "Dropping FTL code block ", *codeBlock, " on the floor because the "
-                "DFG code block ", *profiledDFGCodeBlock, " was jettisoned.\n");
+                "Dropping FTL code block ", codeBlock, " on the floor because the "
+                "DFG code block ", profiledDFGCodeBlock, " was jettisoned.\n");
         }
         return;
     }

Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (233771 => 233772)


--- trunk/Source/_javascript_Core/jit/JITOperations.cpp	2018-07-12 17:03:41 UTC (rev 233771)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp	2018-07-12 17:39:48 UTC (rev 233772)
@@ -1537,8 +1537,9 @@
             return encodeResult(0, 0);
         }
     } else if (codeBlock->hasOptimizedReplacement()) {
+        CodeBlock* replacement = codeBlock->replacement();
         if (UNLIKELY(Options::verboseOSR()))
-            dataLog("Considering OSR ", *codeBlock, " -> ", *codeBlock->replacement(), ".\n");
+            dataLog("Considering OSR ", codeBlock, " -> ", replacement, ".\n");
         // If we have an optimized replacement, then it must be the case that we entered
         // cti_optimize from a loop. That's because if there's an optimized replacement,
         // then all calls to this function will be relinked to the replacement and so
@@ -1552,14 +1553,14 @@
         // attempt OSR entry. Hence it might even be correct for
         // shouldReoptimizeFromLoopNow() to always return true. But we make it do some
         // additional checking anyway, to reduce the amount of recompilation thrashing.
-        if (codeBlock->replacement()->shouldReoptimizeFromLoopNow()) {
+        if (replacement->shouldReoptimizeFromLoopNow()) {
             CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize from loop now"));
             if (UNLIKELY(Options::verboseOSR())) {
                 dataLog(
-                    "Triggering reoptimization of ", *codeBlock,
-                    "(", *codeBlock->replacement(), ") (in loop).\n");
+                    "Triggering reoptimization of ", codeBlock,
+                    "(", replacement, ") (in loop).\n");
             }
-            codeBlock->replacement()->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTrigger, CountReoptimization);
+            replacement->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTrigger, CountReoptimization);
             return encodeResult(0, 0);
         }
     } else {
@@ -1602,13 +1603,13 @@
     }
     
     CodeBlock* optimizedCodeBlock = codeBlock->replacement();
-    ASSERT(JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
+    ASSERT(optimizedCodeBlock && JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
     
     if (void* dataBuffer = DFG::prepareOSREntry(exec, optimizedCodeBlock, bytecodeIndex)) {
         CODEBLOCK_LOG_EVENT(optimizedCodeBlock, "osrEntry", ("at bc#", bytecodeIndex));
         if (UNLIKELY(Options::verboseOSR())) {
             dataLog(
-                "Performing OSR ", *codeBlock, " -> ", *optimizedCodeBlock, ".\n");
+                "Performing OSR ", codeBlock, " -> ", optimizedCodeBlock, ".\n");
         }
 
         codeBlock->optimizeSoon();
@@ -1620,7 +1621,7 @@
 
     if (UNLIKELY(Options::verboseOSR())) {
         dataLog(
-            "Optimizing ", *codeBlock, " -> ", *codeBlock->replacement(),
+            "Optimizing ", codeBlock, " -> ", codeBlock->replacement(),
             " succeeded, OSR failed, after a delay of ",
             codeBlock->optimizationDelayCounter(), ".\n");
     }
@@ -1641,8 +1642,8 @@
         CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize now"));
         if (UNLIKELY(Options::verboseOSR())) {
             dataLog(
-                "Triggering reoptimization of ", *codeBlock, " -> ",
-                *codeBlock->replacement(), " (after OSR fail).\n");
+                "Triggering reoptimization of ", codeBlock, " -> ",
+                codeBlock->replacement(), " (after OSR fail).\n");
         }
         optimizedCodeBlock->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTriggerOnOSREntryFail, CountReoptimization);
         return encodeResult(0, 0);
@@ -1662,6 +1663,9 @@
     NativeCallFrameTracer tracer(&vm, exec);
 
     CodeBlock* optimizedReplacement = exec->codeBlock()->replacement();
+    if (UNLIKELY(!optimizedReplacement))
+        return nullptr;
+
     switch (optimizedReplacement->jitType()) {
     case JITCode::DFGJIT:
     case JITCode::FTLJIT: {
@@ -1681,6 +1685,8 @@
 
     CodeBlock* codeBlock = exec->codeBlock();
     CodeBlock* optimizedReplacement = codeBlock->replacement();
+    if (UNLIKELY(!optimizedReplacement))
+        return nullptr;
 
     switch (optimizedReplacement->jitType()) {
     case JITCode::DFGJIT:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to