[Webkit-unassigned] [Bug 103707] New: AssemblyHelpers::decodedCodeMapFor crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=103707

           Summary: AssemblyHelpers::decodedCodeMapFor crash
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: manjian2006 at gmail.com
                CC: wangyg at ucweb.com


when jit compiles the following function ,
function f(){this.init.apply(this,arguments)}
CodeBlock::canCompileWithDFG says its DFG::CapabilityLevel should be DFG::ShouldProfile.But when it comes to jit code map info collection phase,which looks like
#if ENABLE(DFG_JIT) || ENABLE(LLINT)
    if (canBeOptimized()
#if ENABLE(LLINT)
        || true
#endif
        ) {
        CompactJITCodeMap::Encoder jitCodeMapEncoder;
        for (unsigned bytecodeOffset = 0; bytecodeOffset < m_labels.size(); ++bytecodeOffset) {
            if (m_labels[bytecodeOffset].isSet())
                jitCodeMapEncoder.append(bytecodeOffset, patchBuffer.offsetOf(m_labels[bytecodeOffset]));
        }
        m_codeBlock->setJITCodeMap(jitCodeMapEncoder.finish());
    }
#endif

it refuse to collect these info,because current jit state is mark to cannot be optimize but should be profiled.
So when it comes to osr compilation phase,
    // 17) Jump into the corresponding baseline JIT code.

    CodeBlock* baselineCodeBlock = m_jit.baselineCodeBlockFor(exit.m_codeOrigin);
    Vector<BytecodeAndMachineOffset>& decodedCodeMap = m_jit.decodedCodeMapFor(baselineCodeBlock);
m_jit.decodedCodeMapFor(baselineCodeBlock); will cause crash.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.