Bug 175812 – We are using valueProfileForBytecodeOffset when there may not be a value profile

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

Currently, switching to this crashes on stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js

ValueProfile* CodeBlock::valueProfileForBytecodeOffset(int bytecodeOffset)
{
    OpcodeID opcodeID = Interpreter::getOpcodeID(instructions()[bytecodeOffset]);
    unsigned length = opcodeLength(opcodeID);
    ValueProfile* result = instructions()[bytecodeOffset + length - 1].u.profile;
#if !ASSERT_DISABLED
    bool found = false;
    for (unsigned i = 0; i < numberOfValueProfiles(); ++i) {
        ValueProfile* profile = valueProfile(i);
        if (profile->m_bytecodeOffset == bytecodeOffset) {
            ASSERT(profile == result);
            found = true;
            break;
        }
    }
    ASSERT(found);
#endif
    return result;
}

I'll fix and land this change

[Saam Barati]

I'm moving to two functions:
ValueProfile& valueProfileForBytecodeOffset(int);
ValueProfile* tryGetValueProfileForBytecodeOffset(int);

[Saam Barati]

Created attachment 318740 [details]
patch

[Michael Saboff]

Comment on attachment 318740 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=318740&action=review

r=me with the suggested build fix.

> Source/JavaScriptCore/jit/JITInlines.h:974
>      ASSERT(valueProfile);

Looks like this line needs to be removed to fix the Debug build.

[Saam Barati]

landed in:
https://trac.webkit.org/changeset/221018/webkit

[Radar WebKit Bug Importer]

<rdar://problem/34014145>