Changeset 44797 in webkit for trunk/JavaScriptCore/jit

Timestamp:

Jun 17, 2009, 11:40:53 PM (16 years ago)

Author:

[email protected]

Message:

<rdar://problem/6974140> REGRESSION(r43849): Crash in cti_op_call_NotJSFunction when getting directions on maps.google.com

Reviewed by Gavin Barraclough

Roll out r43849 as it appears that we cannot rely on the address of
an objects property storage being constant even if the structure is
unchanged.

Location:

trunk/JavaScriptCore/jit

Files:

• JIT.h (modified) (1 diff)
• JITPropertyAccess.cpp (modified) (5 diffs)

trunk/JavaScriptCore/jit/JIT.h

@@ -460 +460 @@
 
         void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
-        void compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 

trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -414 +414 @@
 }
 
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset)
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset)
 {
     if (base->isUsingInlineStorage())
         loadPtr(static_cast<void*>(&base->m_inlineStorage[cachedOffset]), result);
-    else
-        loadPtr(static_cast<void*>(&base->m_externalStorage[cachedOffset]), result);
+    else {
+        PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
+        loadPtr(static_cast<void*>(protoPropertyStorage), temp);
+        loadPtr(Address(temp, cachedOffset * sizeof(JSValue)), result);
+    } 
 }
 
@@ -615 +618 @@
 
     // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT0, cachedOffset);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
@@ -690 +693 @@
 
     // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT0, cachedOffset);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
@@ -744 +747 @@
     ASSERT(protoObject);
 
-    compileGetDirectOffset(protoObject, regT0, cachedOffset);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
@@ -797 +800 @@
     ASSERT(protoObject);
 
-    compileGetDirectOffset(protoObject, regT0, cachedOffset);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();