<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Remove AllocationProfileWatchpoint node"
href="https://bugs.webkit.org/show_bug.cgi?id=143999#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Remove AllocationProfileWatchpoint node"
href="https://bugs.webkit.org/show_bug.cgi?id=143999">bug 143999</a>
from <span class="vcard"><a class="email" href="mailto:basile_clement@apple.com" title="Basile Clement <basile_clement@apple.com>"> <span class="fn">Basile Clement</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=143999#c3">comment #3</a>)
<span class="quote">> Comment on <span class=""><a href="attachment.cgi?id=251246&action=diff" name="attach_251246" title="Tentative patch, non thread-safe">attachment 251246</a> <a href="attachment.cgi?id=251246&action=edit" title="Tentative patch, non thread-safe">[details]</a></span>
> Tentative patch, non thread-safe
>
> View in context:
> <a href="https://bugs.webkit.org/attachment.cgi?id=251246&action=review">https://bugs.webkit.org/attachment.cgi?id=251246&action=review</a>
>
> >> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:2643
> >> if (Structure* structure = function->allocationStructure()) {
> >
> > We probably need to freeze the rare data here, in case it is removed by the JS thread and then the GC runs at that point.
> > Not sure how to do this, I first need to investigate more deeply how freeze() & the GC works.
>
> It seems that you're using JSFunction's helpers to get things from the rare
> data. I would make this explicit here, so instead of
> function->allocationStructure() you'd do something like
> rareData->allocationStructure(). And instead of
> function->allocationProfileWatchpointSet() you'd do
> rareData->allocationProfileWatchpointSet().</span >
I had this discussion with Michael yesterday who told me keeping the accessors would be better, but that is indeed problematic here. I will change that.
<span class="quote">>
> Then you'd do:
>
> FunctionRareData* rareData = function->rareData();
> if (rareData) {
> if (Structure* structure = rareData->structure()) {
> m_graph.freeze(rareData);</span >
Right, the m_graph.freeze(rareData) was the thing I was not sure would be sufficient (thought I needed to store it somewhere).
Shouldn't it rather be:
if (rareData) {
m_graph.freeze(rareData);
if (Structure* structure = rareData->structure()) {
...
}
}
in case the rare data is deallocated in between the two ifs (this shouldn't matter after <a class="bz_bug_link
bz_status_NEW "
title="NEW - Don't de-allocate FunctionRareData"
href="show_bug.cgi?id=144000">https://bugs.webkit.org/show_bug.cgi?id=144000</a> is taken care of)?
Thanks!</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>