Changeset 91883 in webkit for trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

Timestamp:

Jul 27, 2011, 4:48:56 PM (14 years ago)

Author:

[email protected]

Message:

​https://bugs.webkit.org/show_bug.cgi?id=65294
DFG JIT - may speculate based on wrong arguments.

Reviewed by Oliver Hunt

In the case of a DFG compiled function calling to and compiling a second function that
also compiles through the DFG JIT (i.e. compilation triggered with DFGOperations.cpp),
we call compileFor passing the caller functions exec state, rather than the callee's.
This may lead to mis-optimization, since the DFG compiler will example the exec state's
arguments on the assumption that these will be passed to the callee - it is wanting the
callee exec state, not the caller's exec state.

Fixing this for all cases of compilation is tricksy, due to the way the numeric sort
function is compiled, & the structure of the calls in the Interpreter::execute methods.
Only fix for compilation from the JIT, in other calls don't speculate based on arguments
for now.

• dfg/DFGOperations.cpp:
• runtime/Executable.cpp:

(JSC::tryDFGCompile):
(JSC::tryDFGCompileFunction):
(JSC::FunctionExecutable::compileForCallInternal):

• runtime/Executable.h:

(JSC::FunctionExecutable::compileForCall):
(JSC::FunctionExecutable::compileFor):

File:

• trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -530 +530 @@
         codePtr = executable->generatedJITCodeFor(kind).addressForCall();
     else {
+        execCallee->setScopeChain(callee->scope());
         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
-        JSObject* error = functionExecutable->compileFor(exec, callee->scope(), kind);
+        JSObject* error = functionExecutable->compileFor(execCallee, callee->scope(), kind);
         if (error) {
             globalData->exception = createStackOverflowError(exec);
@@ -541 +542 @@
         else
             codePtr = functionExecutable->generatedJITCodeWithArityCheckFor(kind);
-        execCallee->setScopeChain(callee->scope());
     }
     CallLinkInfo& callLinkInfo = exec->codeBlock()->getCallLinkInfo(returnAddress);
@@ -575 +575 @@
     
     JSFunction* function = asFunction(calleeAsFunctionCell);
+    execCallee->setScopeChain(function->scopeUnchecked());
     ExecutableBase* executable = function->executable();
     if (UNLIKELY(!executable->hasJITCodeFor(kind))) {
         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
-        JSObject* error = functionExecutable->compileFor(exec, function->scope(), kind);
+        JSObject* error = functionExecutable->compileFor(execCallee, function->scope(), kind);
         if (error) {
             exec->globalData().exception = error;
@@ -584 +585 @@
         }
     }
-    execCallee->setScopeChain(function->scopeUnchecked());
     return executable->generatedJITCodeWithArityCheckFor(kind).executableAddress();
 }