Bug 201331 – [JSC] DFG ByteCodeParser should not copy JIT-related part of SimpleJumpTable

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Yusuke Suzuki]

...

[Yusuke Suzuki]

<rdar://problem/53977605>

[Yusuke Suzuki]

Created attachment 377679 [details]
Patch

[Mark Lam]

Comment on attachment 377679 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=377679&action=review

r=me

> Source/JavaScriptCore/ChangeLog:9
> +        For example, ctiOffsets can be grown by Baseline JIT compiler. There is race condition as follows.

Interesting.  I've seen races between the mutator and the DFG before, but this is the first time I've heard of a race between the baselineJIT and the DFG.

> Source/JavaScriptCore/bytecode/JumpTable.h:80
>          // FIXME: The two Vectors can be combind into one Vector<OffsetLocation>

Not your typo but might as well fix: /combind/combined/

> Source/JavaScriptCore/bytecode/JumpTable.h:122
> +#if ENABLE(DFG_JIT)
>          void clear()

This looks legit to me, but I hope you've tested it with a test build with ENABLE_DFG_JIT set to false.

[Yusuke Suzuki]

Comment on attachment 377679 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=377679&action=review

>> Source/JavaScriptCore/bytecode/JumpTable.h:80
>>          // FIXME: The two Vectors can be combind into one Vector<OffsetLocation>
> 
> Not your typo but might as well fix: /combind/combined/

Fixed.

>> Source/JavaScriptCore/bytecode/JumpTable.h:122
>>          void clear()
> 
> This looks legit to me, but I hope you've tested it with a test build with ENABLE_DFG_JIT set to false.

I checked this function is only called from DFGJITCompiler.cpp's finalizing timing, and make it `ENABLE(DFG_JIT)`.

[Yusuke Suzuki]

Committed r249319: <https://trac.webkit.org/changeset/249319>