Changeset 37268 in webkit for trunk/JavaScriptCore

Timestamp:

Oct 3, 2008, 5:10:29 PM (17 years ago)

Author:

[email protected]

Message:

2008-10-03 Cameron Zwarich <​[email protected]>

Reviewed by Maciej Stachowiak.

Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
<​https://bugs.webkit.org/show_bug.cgi?id=21343>

A fix was landed for this issue in r37253, and the ChangeLog assumes
that it is a compiler bug, but it turns out that it is a subtle issue
with mixing signed and unsigned 32-bit values in a 64-bit environment.
In order to properly fix this bug, we should convert our signed offsets
into the register file to use ptrdiff_t.

This may not be the only instance of this issue, but I will land this
fix first and look for more later.

• VM/Machine.cpp: (JSC::Machine::getArgumentsData):
• VM/Machine.h:
• kjs/Arguments.cpp: (JSC::Arguments::getOwnPropertySlot):
• kjs/Arguments.h: (JSC::Arguments::init):

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• VM/Machine.cpp (modified) (1 diff)
• VM/Machine.h (modified) (1 diff)
• kjs/Arguments.cpp (modified) (2 diffs)
• kjs/Arguments.h (modified) (2 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-10-03  Cameron Zwarich  <[email protected]>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
+        <https://bugs.webkit.org/show_bug.cgi?id=21343>
+
+        A fix was landed for this issue in r37253, and the ChangeLog assumes
+        that it is a compiler bug, but it turns out that it is a subtle issue
+        with mixing signed and unsigned 32-bit values in a 64-bit environment.
+        In order to properly fix this bug, we should convert our signed offsets
+        into the register file to use ptrdiff_t.
+
+        This may not be the only instance of this issue, but I will land this
+        fix first and look for more later.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::getArgumentsData):
+        * VM/Machine.h:
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        * kjs/Arguments.h:
+        (JSC::Arguments::init):
+
 2008-10-03  Darin Adler  <[email protected]>
 

trunk/JavaScriptCore/VM/Machine.cpp

@@ -3929 +3929 @@
 }
 
-void Machine::getArgumentsData(Register* callFrame, JSFunction*& function, int& firstParameterIndex, Register*& argv, int& argc)
+void Machine::getArgumentsData(Register* callFrame, JSFunction*& function, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc)
 {
     function = static_cast<JSFunction*>(callFrame[RegisterFile::Callee].getJSValue());

trunk/JavaScriptCore/VM/Machine.h

@@ -108 +108 @@
         static CodeBlock* codeBlock(const Register* r) { return r[RegisterFile::CodeBlock].codeBlock(); }
 
-        void getArgumentsData(Register* callFrame, JSFunction*&, int& firstParameterIndex, Register*& argv, int& argc);
+        void getArgumentsData(Register* callFrame, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         void setTimeoutTime(unsigned timeoutTime) { m_timeoutTime = timeoutTime; }
         

trunk/JavaScriptCore/kjs/Arguments.cpp

@@ -112 +112 @@
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters) {
-#if COMPILER(GCC) && PLATFORM(X86_64)
-            // The subscript variable is a workaround for a 64-bit code
-            // generation bug in GCC.
-            int subscript = d->firstParameterIndex + i;
-            slot.setRegisterSlot(&d->registers[subscript]);
-#else
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
-#endif
         } else
             slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
@@ -134 +127 @@
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters) {
-#if COMPILER(GCC) && PLATFORM(X86_64)
-            // The subscript variable is a workaround for a 64-bit code
-            // generation bug in GCC.
-            int subscript = d->firstParameterIndex + i;
-            slot.setRegisterSlot(&d->registers[subscript]);
-#else
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
-#endif
         } else
             slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));

trunk/JavaScriptCore/kjs/Arguments.h

@@ -36 +36 @@
 
         unsigned numParameters;
-        int firstParameterIndex;
+        ptrdiff_t firstParameterIndex;
         unsigned numArguments;
 
@@ -85 +85 @@
     {
         JSFunction* callee;
-        int firstParameterIndex;
+        ptrdiff_t firstParameterIndex;
         Register* argv;
         int numArguments;