Changeset 209725 in webkit for trunk/Source/JavaScriptCore/dfg/DFGMinifiedNode.h

Timestamp:

Dec 12, 2016, 1:46:45 PM (9 years ago)

Author:

[email protected]

Message:

REGRESSION(r209653): speedometer crashes making virtual slow path tailcalls
​https://bugs.webkit.org/show_bug.cgi?id=165748

Reviewed by Filip Pizlo.

JSTests:

New regression test.

• stress/regress-165748.js: Added.

(sum1):
(sum2):
(sum3):
(sum4):
(sum5):
(sum6):
(tailCaller):
(test):

Source/JavaScriptCore:

The virtual slow path for tailcalls always passes arguments on the stack.
The fix here is to link to the stack argument entrypoint instead of a register
argument entrypoint.

While fixing this bug, I found that we weren't clearing the code origin when
shuffling the call frame for a register argument tailcall.

Also rolling back in r209653, r209654, r209663, and r209673.

• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::prepareAny):

• jit/ThunkGenerators.cpp:

(JSC::virtualThunkFor):

Source/WTF:

Rolling back in r209653, r209654, r209663, and r209673.

• wtf/Platform.h:

File:

• trunk/Source/JavaScriptCore/dfg/DFGMinifiedNode.h (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGMinifiedNode.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2012, 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2012, 2014-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -44 +44 @@
     case PhantomDirectArguments:
     case PhantomClonedArguments:
+    case GetArgumentRegister:
         return true;
     default:
@@ -72 +73 @@
         return bitwise_cast<InlineCallFrame*>(static_cast<uintptr_t>(m_info));
     }
+
+    bool hasArgumentIndex() const { return hasArgumentIndex(m_op); }
+
+    unsigned argumentIndex() const { return static_cast<unsigned>(m_info); }
     
     static MinifiedID getID(MinifiedNode* node) { return node->id(); }
@@ -89 +94 @@
         return type == PhantomDirectArguments || type == PhantomClonedArguments;
     }
+
+    static bool hasArgumentIndex(NodeType type)
+    {
+        return type == GetArgumentRegister;
+    }
     
     MinifiedID m_id;