<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[205606] releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/205606">205606</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-09-08 01:23:42 -0700 (Thu, 08 Sep 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/205254">r205254</a> - [JSC] AbstractValue can contain padding which is not zero-filled
https://bugs.webkit.org/show_bug.cgi?id=161427
Reviewed by Saam Barati.
We checked that AbstractValue is zero-filled when initializing it to ensure
that zero-filled memory can be used as the initialized AbstractValue.
However, since the size of SpeculatedType becomes 64bit, AbstractValue can have
padding now. And this padding is not ensured that it is initialized with zeros.
So debug assertion fails when building with GCC.
This patch changes the strategy. Instead of checking the initialized
AbstractValue is zero-filled, we ensure that zero-filled AbstractValue can be
considered to be equal to the initialized AbstractValue.
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::ensureCanInitializeWithZeros):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::AbstractValue):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreChangeLog">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoredfgDFGAbstractValuecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoredfgDFGAbstractValueh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog (205605 => 205606)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog 2016-09-08 08:23:35 UTC (rev 205605)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog 2016-09-08 08:23:42 UTC (rev 205606)
</span><span class="lines">@@ -1,3 +1,25 @@
</span><ins>+2016-08-31 Yusuke Suzuki <utatane.tea@gmail.com>
+
+ [JSC] AbstractValue can contain padding which is not zero-filled
+ https://bugs.webkit.org/show_bug.cgi?id=161427
+
+ Reviewed by Saam Barati.
+
+ We checked that AbstractValue is zero-filled when initializing it to ensure
+ that zero-filled memory can be used as the initialized AbstractValue.
+ However, since the size of SpeculatedType becomes 64bit, AbstractValue can have
+ padding now. And this padding is not ensured that it is initialized with zeros.
+ So debug assertion fails when building with GCC.
+
+ This patch changes the strategy. Instead of checking the initialized
+ AbstractValue is zero-filled, we ensure that zero-filled AbstractValue can be
+ considered to be equal to the initialized AbstractValue.
+
+ * dfg/DFGAbstractValue.cpp:
+ (JSC::DFG::AbstractValue::ensureCanInitializeWithZeros):
+ * dfg/DFGAbstractValue.h:
+ (JSC::DFG::AbstractValue::AbstractValue):
+
</ins><span class="cx"> 2016-08-30 Benjamin Poulain <bpoulain@apple.com>
</span><span class="cx">
</span><span class="cx"> [JSC] Some arith nodes are too pessimistic with the types supported on the fast path
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoredfgDFGAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (205605 => 205606)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2016-09-08 08:23:35 UTC (rev 205605)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2016-09-08 08:23:42 UTC (rev 205606)
</span><span class="lines">@@ -539,6 +539,15 @@
</span><span class="cx"> m_structure.validateReferences(trackedReferences);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+#if USE(JSVALUE64) && !defined(NDEBUG)
+void AbstractValue::ensureCanInitializeWithZeros()
+{
+ std::aligned_storage<sizeof(AbstractValue), alignof(AbstractValue)>::type zeroFilledStorage;
+ memset(static_cast<void*>(&zeroFilledStorage), 0, sizeof(AbstractValue));
+ ASSERT(*this == *static_cast<AbstractValue*>(static_cast<void*>(&zeroFilledStorage)));
+}
+#endif
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> #endif // ENABLE(DFG_JIT)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoredfgDFGAbstractValueh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.h (205605 => 205606)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2016-09-08 08:23:35 UTC (rev 205605)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2016-09-08 08:23:42 UTC (rev 205606)
</span><span class="lines">@@ -61,9 +61,7 @@
</span><span class="cx"> static bool needsDefaultConstructorCheck = true;
</span><span class="cx"> if (needsDefaultConstructorCheck) {
</span><span class="cx"> needsDefaultConstructorCheck = false;
</span><del>-
- for (unsigned i = 0; i < sizeof(AbstractValue); ++i)
- ASSERT(!(reinterpret_cast<char*>(this)[i]));
</del><ins>+ ensureCanInitializeWithZeros();
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="lines">@@ -459,6 +457,10 @@
</span><span class="cx">
</span><span class="cx"> void filterValueByType();
</span><span class="cx"> void filterArrayModesByType();
</span><ins>+
+#if USE(JSVALUE64) && !defined(NDEBUG)
+ void ensureCanInitializeWithZeros();
+#endif
</ins><span class="cx">
</span><span class="cx"> bool shouldBeClear() const;
</span><span class="cx"> FiltrationResult normalizeClarity();
</span></span></pre>
</div>
</div>
</body>
</html>