<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Remove AllocationProfileWatchpoint node"
href="https://bugs.webkit.org/show_bug.cgi?id=143999#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Remove AllocationProfileWatchpoint node"
href="https://bugs.webkit.org/show_bug.cgi?id=143999">bug 143999</a>
from <span class="vcard"><a class="email" href="mailto:fpizlo@apple.com" title="Filip Pizlo <fpizlo@apple.com>"> <span class="fn">Filip Pizlo</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=143999#c4">comment #4</a>)
<span class="quote">> (In reply to <a href="show_bug.cgi?id=143999#c3">comment #3</a>)
> > Comment on <span class=""><a href="attachment.cgi?id=251246&action=diff" name="attach_251246" title="Tentative patch, non thread-safe">attachment 251246</a> <a href="attachment.cgi?id=251246&action=edit" title="Tentative patch, non thread-safe">[details]</a></span>
> > Tentative patch, non thread-safe
> >
> > View in context:
> > <a href="https://bugs.webkit.org/attachment.cgi?id=251246&action=review">https://bugs.webkit.org/attachment.cgi?id=251246&action=review</a>
> >
> > >> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:2643
> > >> if (Structure* structure = function->allocationStructure()) {
> > >
> > > We probably need to freeze the rare data here, in case it is removed by the JS thread and then the GC runs at that point.
> > > Not sure how to do this, I first need to investigate more deeply how freeze() & the GC works.
> >
> > It seems that you're using JSFunction's helpers to get things from the rare
> > data. I would make this explicit here, so instead of
> > function->allocationStructure() you'd do something like
> > rareData->allocationStructure(). And instead of
> > function->allocationProfileWatchpointSet() you'd do
> > rareData->allocationProfileWatchpointSet().
>
> I had this discussion with Michael yesterday who told me keeping the
> accessors would be better, but that is indeed problematic here. I will
> change that.
>
> >
> > Then you'd do:
> >
> > FunctionRareData* rareData = function->rareData();
> > if (rareData) {
> > if (Structure* structure = rareData->structure()) {
> > m_graph.freeze(rareData);
>
> Right, the m_graph.freeze(rareData) was the thing I was not sure would be
> sufficient (thought I needed to store it somewhere).
> Shouldn't it rather be:
>
> if (rareData) {
> m_graph.freeze(rareData);
> if (Structure* structure = rareData->structure()) {
> ...
> }
> }
>
> in case the rare data is deallocated in between the two ifs (this shouldn't
> matter after <a class="bz_bug_link
bz_status_NEW "
title="NEW - Don't de-allocate FunctionRareData"
href="show_bug.cgi?id=144000">https://bugs.webkit.org/show_bug.cgi?id=144000</a> is taken care
> of)?</span >
It's safe to assume that a GC cannot happen during a DFG phase. The parser counts as a phase. Hence, you only need to freeze it if you decide that you'll be using it after parsing completes - i.e. exactly if/when you addLazily().
<span class="quote">>
> Thanks!</span ></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>