Bug 72313

Summary: DFG's inline references to objects should be tracked
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on:    
Bug Blocks: 72312    
Attachments:
Description Flags
the patch
fpizlo: review-
the patch barraclough: review+

Filip Pizlo
Reported 2011-11-14 14:30:54 PST
The DFG may emit code that refers to objects in the heap. This is only safe because those same objects would be referenced from inline caches maintained by the old JIT, which only works because the old JIT will never clear inline caches.
Attachments
the patch (6.96 KB, patch)
2011-11-14 14:37 PST, Filip Pizlo 		fpizlo: review-
DetailsFormatted DiffDiff
the patch (6.47 KB, patch)
2011-11-14 16:02 PST, Filip Pizlo 		barraclough: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-11-14 14:37:35 PST
Created attachment 115033 [details] the patch
Filip Pizlo
Comment 2 2011-11-14 14:44:42 PST
Comment on attachment 115033 [details] the patch r=oliver
Filip Pizlo
Comment 3 2011-11-14 16:02:04 PST
Comment on attachment 115033 [details] the patch This is broken.
Filip Pizlo
Comment 4 2011-11-14 16:02:38 PST
Created attachment 115051 [details] the patch
Filip Pizlo
Comment 5 2011-11-14 17:23:19 PST
Landed in http://trac.webkit.org/changeset/100221
Note You need to log in before you can comment on or make changes to this bug.