Changeset 99148 in webkit for trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

Timestamp:

Nov 3, 2011, 1:06:42 AM (14 years ago)

Author:

[email protected]

Message:

Source/JavaScriptCore: DFG inlining breaks function.arguments[something] if the argument being
retrieved was subjected to DFG's unboxing optimizations
​https://bugs.webkit.org/show_bug.cgi?id=71436

Reviewed by Oliver Hunt.

This makes inlined arguments retrieval use some of the same machinery as
OSR to determine where from, and how, to retrieve a value that the DFG
might have somehow squirreled away while the old JIT would put it in its
obvious location, using an obvious format.

To that end, previously DFG-internal notions such as DataFormat,
VirtualRegister, and ValueRecovery are now in bytecode/ since they are
stored as part of InlineCallFrames.

• bytecode/CodeOrigin.h:
• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::exitSpeculativeWithOSR):

• dfg/DFGJITCompiler32_64.cpp:

(JSC::DFG::JITCompiler::exitSpeculativeWithOSR):

• dfg/DFGNode.h:
• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::propagateNodePredictions):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• interpreter/CallFrame.cpp:

(JSC::CallFrame::trueCallerFrame):

• interpreter/CallFrame.h:

(JSC::ExecState::inlineCallFrame):

• interpreter/Register.h:

(JSC::Register::asInlineCallFrame):
(JSC::Register::unboxedInt32):
(JSC::Register::unboxedBoolean):
(JSC::Register::unboxedCell):

• runtime/Arguments.h:

(JSC::Arguments::finishCreationAndCopyRegisters):

LayoutTests: DFG inlining breaks function.arguments[something] if the argument being
retrieved was subjected to DFG's unboxing optimizations
​https://bugs.webkit.org/show_bug.cgi?id=71436

Reviewed by Oliver Hunt.

• fast/js/dfg-inline-arguments-int32-expected.txt: Added.
• fast/js/dfg-inline-arguments-int32.html: Added.
• fast/js/script-tests/dfg-inline-arguments-int32.js: Added.

(foo):
(bar):
(baz):
(argsToStr):

File:

• trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

@@ -27 +27 @@
 #define CodeOrigin_h
 
+#include "ValueRecovery.h"
 #include "WriteBarrier.h"
 #include <wtf/StdLibExtras.h>
@@ -76 +77 @@
 
 struct InlineCallFrame {
+    Vector<ValueRecovery> arguments;
     WriteBarrier<ExecutableBase> executable;
     WriteBarrier<JSFunction> callee;
     CodeOrigin caller;
-    unsigned stackOffset;
-    unsigned numArgumentsIncludingThis : 31;
+    unsigned stackOffset : 31;
     bool isCall : 1;
 };