[Webkit-unassigned] [Bug 143999] Remove AllocationProfileWatchpoint node

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=143999

--- Comment #3 from Filip Pizlo <fpizlo at apple.com> ---
Comment on attachment 251246
  --> https://bugs.webkit.org/attachment.cgi?id=251246
Tentative patch, non thread-safe

View in context: https://bugs.webkit.org/attachment.cgi?id=251246&action=review

>> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:2643
>>                  if (Structure* structure = function->allocationStructure()) {
> 
> We probably need to freeze the rare data here, in case it is removed by the JS thread and then the GC runs at that point.
> Not sure how to do this, I first need to investigate more deeply how freeze() & the GC works.

It seems that you're using JSFunction's helpers to get things from the rare data.  I would make this explicit here, so instead of function->allocationStructure() you'd do something like rareData->allocationStructure().  And instead of function->allocationProfileWatchpointSet() you'd do rareData->allocationProfileWatchpointSet().

Then you'd do:

FunctionRareData* rareData = function->rareData();
if (rareData) {
    if (Structure* structure = rareData->structure()) {
        m_graph.freeze(rareData);
        m_graph.watchpoints().addLazily(rareData->allocationProfileWatchpointSet()); // note that here you don't have to do any null checking - you know that rareData has the InlineWatchpointSet in place rather than via pointer.
        ... the rest
    }
}

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150421/ced58cca/attachment-0001.html>