Changeset 103294 in webkit for trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

Timestamp:

Dec 19, 2011, 7:16:21 PM (13 years ago)

Author:

[email protected]

Message:

​https://bugs.webkit.org/show_bug.cgi?id=74903
Exceptions not thrown correctly from DFG JIT on 32bit

Reviewed by Oliver Hunt.

Arguments for lookupExceptionHandler are not setup correctly.
In the case of ARMv7 we rely on lr being preserved over a call,
this in invalid. On x86 we don't should be poking the arguments onto the stack!

Source/JavaScriptCore:

• bytecode/CodeBlock.h:

(JSC::CodeBlock::bytecodeOffsetForCallAtIndex):

• dfg/DFGAssemblyHelpers.h:

(JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):

• dfg/DFGGPRInfo.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileBody):

• dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::addExceptionCheck):
(JSC::DFG::JITCompiler::addFastExceptionCheck):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:

LayoutTests:

• fast/js/dfg-exception-expected.txt: Added.
• fast/js/dfg-exception.html: Added.
• fast/js/script-tests/dfg-exception.js: Added.

(doesntDFGCompile):
(test):

File:

• trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -96 +96 @@
     if (didLinkExceptionCheck) {
         // lookupExceptionHandler is passed two arguments, exec (the CallFrame*), and
-        // an identifier for the operation that threw the exception, which we can use
-        // to look up handler information. The identifier we use is the return address
-        // of the call out from JIT code that threw the exception; this is still
-        // available on the stack, just below the stack pointer!
+        // the index into the CodeBlock's callReturnIndexVector corresponding to the
+        // call that threw the exception (this was set in nonPreservedNonReturnGPR, when
+        // the exception check was planted).
+        move(GPRInfo::nonPreservedNonReturnGPR, GPRInfo::argumentGPR1);
         move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
-        getPCAfterCall(GPRInfo::argumentGPR1);
+#if CPU(X86)
+        // FIXME: should use the call abstraction, but this is currently in the SpeculativeJIT layer!
+        poke(GPRInfo::argumentGPR0);
+        poke(GPRInfo::argumentGPR1, 1);
+#endif
         m_calls.append(CallLinkRecord(call(), lookupExceptionHandler));
         // lookupExceptionHandler leaves the handler CallFrame* in the returnValueGPR,