Changeset 209725 in webkit for trunk/Source/JavaScriptCore/interpreter/ShadowChicken.cpp

Timestamp:

Dec 12, 2016, 1:46:45 PM (9 years ago)

Author:

[email protected]

Message:

REGRESSION(r209653): speedometer crashes making virtual slow path tailcalls
​https://bugs.webkit.org/show_bug.cgi?id=165748

Reviewed by Filip Pizlo.

JSTests:

New regression test.

• stress/regress-165748.js: Added.

(sum1):
(sum2):
(sum3):
(sum4):
(sum5):
(sum6):
(tailCaller):
(test):

Source/JavaScriptCore:

The virtual slow path for tailcalls always passes arguments on the stack.
The fix here is to link to the stack argument entrypoint instead of a register
argument entrypoint.

While fixing this bug, I found that we weren't clearing the code origin when
shuffling the call frame for a register argument tailcall.

Also rolling back in r209653, r209654, r209663, and r209673.

• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::prepareAny):

• jit/ThunkGenerators.cpp:

(JSC::virtualThunkFor):

Source/WTF:

Rolling back in r209653, r209654, r209663, and r209673.

• wtf/Platform.h:

File:

• trunk/Source/JavaScriptCore/interpreter/ShadowChicken.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/interpreter/ShadowChicken.cpp

@@ -298 +298 @@
             bool isTailDeleted = false;
             JSScope* scope = nullptr;
+            JSValue thisValue = jsUndefined();
             CodeBlock* codeBlock = callFrame->codeBlock();
-            if (codeBlock && codeBlock->wasCompiledWithDebuggingOpcodes() && codeBlock->scopeRegister().isValid()) {
-                scope = callFrame->scope(codeBlock->scopeRegister().offset());
-                RELEASE_ASSERT(scope->inherits(JSScope::info()));
+            if (codeBlock && codeBlock->wasCompiledWithDebuggingOpcodes()) {
+                if (codeBlock->scopeRegister().isValid()) {
+                    scope = callFrame->scope(codeBlock->scopeRegister().offset());
+                    RELEASE_ASSERT(scope->inherits(JSScope::info()));
+                }
+                thisValue = callFrame->thisValue();
             } else if (foundFrame) {
-                scope = m_log[indexInLog].scope;
-                if (scope)
-                    RELEASE_ASSERT(scope->inherits(JSScope::info()));
-            }
-            toPush.append(Frame(jsCast<JSObject*>(visitor->callee()), callFrame, isTailDeleted, callFrame->thisValue(), scope, codeBlock, callFrame->callSiteIndex()));
+                if (!scope) {
+                    scope = m_log[indexInLog].scope;
+                    if (scope)
+                        RELEASE_ASSERT(scope->inherits(JSScope::info()));
+                }
+                if (thisValue.isUndefined())
+                    thisValue = m_log[indexInLog].thisValue;
+            }
+            toPush.append(Frame(jsCast<JSObject*>(visitor->callee()), callFrame, isTailDeleted, thisValue, scope, codeBlock, callFrame->callSiteIndex()));
 
             if (indexInLog < logCursorIndex