Changeset 264804 in webkit for trunk/Source/JavaScriptCore/ftl/FTLOSREntry.cpp

Timestamp:

Jul 23, 2020, 4:08:19 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] FTL OSR entry should store boxed |this|
​https://bugs.webkit.org/show_bug.cgi?id=214675
<rdar://problem/65474072>

Reviewed by Michael Saboff and Mark Lam.

In this patch, after ensuring that we will go to FTL OSR entry, we store boxed |this| instead of the unboxed value
to agree to the FTL assumption that all arguments should be boxed.

• dfg/DFGOperations.cpp:
• ftl/FTLOSREntry.cpp:

(JSC::FTL::prepareOSREntry):

File:

• trunk/Source/JavaScriptCore/ftl/FTLOSREntry.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ftl/FTLOSREntry.cpp

@@ -71 +71 @@
     dataLogLnIf(Options::verboseOSR(), "    Values at entry: ", values);
     
+    Optional<JSValue> reconstructedThis;
     for (int argument = values.numberOfArguments(); argument--;) {
         JSValue valueOnStack = callFrame->r(virtualRegisterForArgumentIncludingThis(argument)).asanUnsafeJSValue();
         Optional<JSValue> reconstructedValue = values.argument(argument);
-        if ((reconstructedValue && valueOnStack == reconstructedValue.value()) || !argument)
+        if (!argument) {
+            // |this| argument can be unboxed. We should store boxed value instead for loop OSR entry since FTL assumes that all arguments are flushed JSValue.
+            // To make this valid, we will modify the stack on the fly: replacing the value with boxed value.
+            reconstructedThis = reconstructedValue;
+            continue;
+        }
+        if (reconstructedValue && valueOnStack == reconstructedValue.value())
             continue;
         dataLog("Mismatch between reconstructed values and the value on the stack for argument arg", argument, " for ", *entryCodeBlock, " at ", bytecodeIndex, ":\n");
@@ -106 +113 @@
     void* result = entryCode->addressForCall(ArityCheckNotRequired).executableAddress();
     dataLogLnIf(Options::verboseOSR(), "    Entry will succeed, going to address ", RawPointer(result));
+
+    // At this point, we're committed to triggering an OSR entry immediately after we return. Hence, it is safe to modify stack here.
+    if (result) {
+        if (reconstructedThis)
+            callFrame->r(virtualRegisterForArgumentIncludingThis(0)) = JSValue::encode(reconstructedThis.value());
+    }
     
     return result;