WebKit Bugzilla
Attachment 342757 Details for
Bug 186630
: REGRESSION(232741): Crash running ARES-6
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
186630.patch (text/plain), 3.16 KB, created by
Michael Saboff
on 2018-06-14 13:29:35 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Michael Saboff
Created:
2018-06-14 13:29:35 PDT
Size:
3.16 KB
patch
obsolete
>Index: Source/JavaScriptCore/ChangeLog >=================================================================== >--- Source/JavaScriptCore/ChangeLog (revision 232850) >+++ Source/JavaScriptCore/ChangeLog (working copy) >@@ -1,3 +1,19 @@ >+2018-06-14 Michael Saboff <msaboff@apple.com> >+ >+ REGRESSION(232741): Crash running ARES-6 >+ https://bugs.webkit.org/show_bug.cgi?id=186630 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ The de-duplicating work in r232741 caused a bug in breakCriticalEdge() where it >+ treated edges between identical predecessor->successor pairs independently. >+ This fixes the issue by handling such edges once, using the added intermediate >+ pad for all instances of the edges between the same pairs. >+ >+ * dfg/DFGCriticalEdgeBreakingPhase.cpp: >+ (JSC::DFG::CriticalEdgeBreakingPhase::run): >+ (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge): Deleted. >+ > 2018-06-14 Carlos Garcia Campos <cgarcia@igalia.com> > > [GTK][WPE] WebDriver: handle acceptInsecureCertificates capability >Index: Source/JavaScriptCore/dfg/DFGCriticalEdgeBreakingPhase.cpp >=================================================================== >--- Source/JavaScriptCore/dfg/DFGCriticalEdgeBreakingPhase.cpp (revision 232848) >+++ Source/JavaScriptCore/dfg/DFGCriticalEdgeBreakingPhase.cpp (working copy) >@@ -56,13 +56,30 @@ public: > > if (block->numSuccessors() <= 1) > continue; >- >+ >+ // Break critical edges by inserting a "Jump" pad block in place of each >+ // unique A->B critical edge. >+ HashMap<BasicBlock*, BasicBlock*> successorPads; >+ > for (unsigned i = block->numSuccessors(); i--;) { > BasicBlock** successor = &block->successor(i); > if ((*successor)->predecessors.size() <= 1) > continue; >- >- breakCriticalEdge(block, successor); >+ >+ BasicBlock* pad = nullptr; >+ auto iter = successorPads.find(*successor); >+ >+ if (iter == successorPads.end()) { >+ pad = m_insertionSet.insertBefore(*successor, (*successor)->executionCount); >+ pad->appendNode( >+ m_graph, SpecNone, Jump, (*successor)->at(0)->origin, OpInfo(*successor)); >+ pad->predecessors.append(block); >+ (*successor)->replacePredecessor(block, pad); >+ successorPads.set(*successor, pad); >+ } else >+ pad = iter->value; >+ >+ *successor = pad; > } > } > >@@ -70,17 +87,6 @@ public: > } > > private: >- void breakCriticalEdge(BasicBlock* predecessor, BasicBlock** successor) >- { >- BasicBlock* pad = m_insertionSet.insertBefore(*successor, (*successor)->executionCount); >- pad->appendNode( >- m_graph, SpecNone, Jump, (*successor)->at(0)->origin, OpInfo(*successor)); >- pad->predecessors.append(predecessor); >- (*successor)->replacePredecessor(predecessor, pad); >- >- *successor = pad; >- } >- > BlockInsertionSet m_insertionSet; > }; >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 186630
: 342757