Changeset 209725 in webkit for trunk/Source/JavaScriptCore/jit/CachedRecovery.h

Timestamp:

Dec 12, 2016, 1:46:45 PM (8 years ago)

Author:

[email protected]

Message:

REGRESSION(r209653): speedometer crashes making virtual slow path tailcalls
​https://bugs.webkit.org/show_bug.cgi?id=165748

Reviewed by Filip Pizlo.

JSTests:

New regression test.

• stress/regress-165748.js: Added.

(sum1):
(sum2):
(sum3):
(sum4):
(sum5):
(sum6):
(tailCaller):
(test):

Source/JavaScriptCore:

The virtual slow path for tailcalls always passes arguments on the stack.
The fix here is to link to the stack argument entrypoint instead of a register
argument entrypoint.

While fixing this bug, I found that we weren't clearing the code origin when
shuffling the call frame for a register argument tailcall.

Also rolling back in r209653, r209654, r209663, and r209673.

• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::prepareAny):

• jit/ThunkGenerators.cpp:

(JSC::virtualThunkFor):

Source/WTF:

Rolling back in r209653, r209654, r209663, and r209673.

• wtf/Platform.h:

File:

• trunk/Source/JavaScriptCore/jit/CachedRecovery.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/jit/CachedRecovery.h

@@ -51 +51 @@
 
     const Vector<VirtualRegister, 1>& targets() const { return m_targets; }
+    const Vector<JSValueRegs, 1>& gprTargets() const { return m_gprTargets; }
 
     void addTarget(VirtualRegister reg)
@@ -69 +70 @@
     }
 
-    void setWantedJSValueRegs(JSValueRegs jsValueRegs)
-    {
-        ASSERT(m_wantedFPR == InvalidFPRReg);
-        m_wantedJSValueRegs = jsValueRegs;
-    }
+    void addTargetJSValueRegs(JSValueRegs);
 
     void setWantedFPR(FPRReg fpr)
     {
-        ASSERT(!m_wantedJSValueRegs);
+        ASSERT(m_gprTargets.isEmpty());
         m_wantedFPR = fpr;
     }
@@ -120 +117 @@
     void setRecovery(ValueRecovery recovery) { m_recovery = recovery; }
 
-    JSValueRegs wantedJSValueRegs() const { return m_wantedJSValueRegs; }
+    JSValueRegs wantedJSValueRegs() const
+    {
+        if (m_gprTargets.isEmpty())
+            return JSValueRegs();
+
+        return m_gprTargets[0];
+    }
 
     FPRReg wantedFPR() const { return m_wantedFPR; }
 private:
     ValueRecovery m_recovery;
-    JSValueRegs m_wantedJSValueRegs;
     FPRReg m_wantedFPR { InvalidFPRReg };
     Vector<VirtualRegister, 1> m_targets;
+    Vector<JSValueRegs, 1> m_gprTargets;
 };