12013-02-28 Filip Pizlo <fpizlo@apple.com>
2
3 CodeBlock::valueProfile() has a bogus assertion
4 https://bugs.webkit.org/show_bug.cgi?id=111106
5 <rdar://problem/13131427>
6
7 Reviewed by NOBODY (OOPS!).
8
9 This was just a bad assertion: m_bytecodeOffset means that the value profile is constructed but not initialized.
10 ValueProfile constructs itself in a safe way; you can call any method you want on a constructed but not initialized
11 ValueProfile. CodeBlock first constructs all ValueProfiles (by growing the ValueProfile vector) and then initializes
12 their m_bytecodeOffset later. This is necessary because the initialization is linking bytecode instructions to their
13 ValueProfiles, so at that point we don't want the ValueProfile vector to resize, which implies that we want all of
14 them to already be constructed. A GC can happen during this phase, and the GC may want to walk all ValueProfiles.
15 This is safe, but one of the ValueProfile getters (CodeBlock::valueProfile()) was asserting that any value profile
16 you get has had its m_bytecodeOffset initialized. This need not be the case and nothing will go wrong if it isn't.
17
18 The solution is to remove the assertion, which I believe was put there to ensure that my m_valueProfiles refactoring
19 a long time ago was sound: it used to be that a ValueProfile with m_bytecodeOffset == -1 was an argument profile; now
20 all argument profiles are in m_argumentValueProfiles instead. I think it's safe to say that this refactoring was done
21 soundly since it was a long time ago. So we should kill the assertion - I don't see an easy way to make the assertion
22 sound with respect to the GC-during-CodeBlock-construction issue, and I don't believe that the assertion is buying us
23 anything at this point.
24
25 * bytecode/CodeBlock.h:
26 (JSC::CodeBlock::valueProfile):
27