Bug 197809

Summary: [JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: New BugsAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch
none
Patch msaboff: review+

Yusuke Suzuki
Reported 2019-05-10 18:39:35 PDT
[JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler
Attachments
Patch (7.34 KB, patch)
2019-05-10 18:40 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Patch (10.27 KB, patch)
2019-05-22 15:48 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Patch (9.80 KB, patch)
2019-05-22 15:51 PDT, Yusuke Suzuki 		msaboff: review+
DetailsFormatted DiffDiff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2019-05-10 18:40:07 PDT
Created attachment 369632 [details] Patch
Yusuke Suzuki
Comment 2 2019-05-22 14:59:12 PDT
<rdar://problem/50536594>
Yusuke Suzuki
Comment 3 2019-05-22 15:48:56 PDT
Created attachment 370456 [details] Patch
Yusuke Suzuki
Comment 4 2019-05-22 15:51:08 PDT
Comment on attachment 370456 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=370456&action=review > Source/JavaScriptCore/bytecode/ArrayAllocationProfile.cpp:68 > + if (!isCompilationThread()) I'll drop this, and putting ASSERT for this in the prologue of this function.
Yusuke Suzuki
Comment 5 2019-05-22 15:51:17 PDT
Created attachment 370457 [details] Patch
Michael Saboff
Comment 6 2019-05-22 15:55:01 PDT
Comment on attachment 370457 [details] Patch r=me
Yusuke Suzuki
Comment 7 2019-05-22 15:56:37 PDT
(In reply to Michael Saboff from comment #6) > Comment on attachment 370457 [details] > Patch > > r=me Thanks!
Yusuke Suzuki
Comment 8 2019-05-22 18:19:29 PDT
Comment on attachment 370457 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=370457&action=review > JSTests/stress/array-allocation-profile-should-not-update-itself-in-concurrent-compiler.js:1 > +//@ runDefault(" --jitPolicyScale=0", "--useArrayAllocationProfiling=0") Fix, removing space before "--jitPolicyScale=0".
Yusuke Suzuki
Comment 9 2019-05-22 18:22:38 PDT
Committed r245667: <https://trac.webkit.org/changeset/245667>
Note You need to log in before you can comment on or make changes to this bug.