Title: [210259] trunk/Source/_javascript_Core
- Revision
- 210259
- Author
- [email protected]
- Date
- 2017-01-03 17:14:59 -0800 (Tue, 03 Jan 2017)
Log Message
REGRESSION (r210244): Release JSC Stress test failure: wasm.yaml/wasm/js-api/wasm-to-wasm.js.default-wasm
https://bugs.webkit.org/show_bug.cgi?id=166669
<rdar://problem/29856455>
Reviewed by Saam Barati.
Bug #165282 added wasm -> wasm calls, but caused crashes in
release builds because the pinned registers are also callee-saved
and were being clobbered. B3 didn't see itself clobbering them
when no memory was used, and therefore omitted a restore.
This was causing the C++ code in callWebAssemblyFunction to crash
because $r12 was 0, and it expected it to have its value prior to
the call.
* wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::createJSToWasmWrapper):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (210258 => 210259)
--- trunk/Source/_javascript_Core/ChangeLog 2017-01-04 00:36:32 UTC (rev 210258)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-01-04 01:14:59 UTC (rev 210259)
@@ -1,3 +1,23 @@
+2017-01-03 JF Bastien <[email protected]>
+
+ REGRESSION (r210244): Release JSC Stress test failure: wasm.yaml/wasm/js-api/wasm-to-wasm.js.default-wasm
+ https://bugs.webkit.org/show_bug.cgi?id=166669
+ <rdar://problem/29856455>
+
+ Reviewed by Saam Barati.
+
+ Bug #165282 added wasm -> wasm calls, but caused crashes in
+ release builds because the pinned registers are also callee-saved
+ and were being clobbered. B3 didn't see itself clobbering them
+ when no memory was used, and therefore omitted a restore.
+
+ This was causing the C++ code in callWebAssemblyFunction to crash
+ because $r12 was 0, and it expected it to have its value prior to
+ the call.
+
+ * wasm/WasmB3IRGenerator.cpp:
+ (JSC::Wasm::createJSToWasmWrapper):
+
2017-01-03 Joseph Pecoraro <[email protected]>
Web Inspector: Address failures under LayoutTests/inspector/debugger/stepping
Modified: trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp (210258 => 210259)
--- trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2017-01-04 00:36:32 UTC (rev 210258)
+++ trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2017-01-04 01:14:59 UTC (rev 210259)
@@ -1064,6 +1064,16 @@
// Move the arguments into place.
Value* result = wasmCallingConvention().setupCall(proc, block, origin, arguments, toB3Type(signature->returnType()), [&] (PatchpointValue* patchpoint) {
CompilationContext* context = &compilationContext;
+
+ // wasm -> wasm calls clobber pinned registers unconditionally. This JS -> wasm transition must therefore restore these pinned registers (which are usually callee-saved) to account for this.
+ const PinnedRegisterInfo* pinnedRegs = &PinnedRegisterInfo::get();
+ RegisterSet clobbers;
+ clobbers.set(pinnedRegs->baseMemoryPointer);
+ for (auto info : pinnedRegs->sizeRegisters)
+ clobbers.set(info.sizeRegister);
+ patchpoint->effects.writesPinned = true;
+ patchpoint->clobber(clobbers);
+
patchpoint->setGenerator([context] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
AllowMacroScratchRegisterUsage allowScratch(jit);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
