Title: [215596] trunk
- Revision
- 215596
- Author
- [email protected]
- Date
- 2017-04-20 17:30:44 -0700 (Thu, 20 Apr 2017)
Log Message
virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
https://bugs.webkit.org/show_bug.cgi?id=171079
<rdar://problem/31684756>
Reviewed by Saam Barati.
JSTests:
* stress/regress-171079.js: Added.
Source/_javascript_Core:
This is needed because tail calls would restore callee saved registers (and
therefore, potentially clobber the tag registers) before jumping to the thunk.
* jit/ThunkGenerators.cpp:
(JSC::virtualThunkFor):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (215595 => 215596)
--- trunk/JSTests/ChangeLog 2017-04-21 00:20:59 UTC (rev 215595)
+++ trunk/JSTests/ChangeLog 2017-04-21 00:30:44 UTC (rev 215596)
@@ -1,3 +1,13 @@
+2017-04-20 Mark Lam <[email protected]>
+
+ virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
+ https://bugs.webkit.org/show_bug.cgi?id=171079
+ <rdar://problem/31684756>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-171079.js: Added.
+
2017-04-15 Filip Pizlo <[email protected]>
Optimize SharedArrayBuffer in the DFG+FTL
Added: trunk/JSTests/stress/regress-171079.js (0 => 215596)
--- trunk/JSTests/stress/regress-171079.js (rev 0)
+++ trunk/JSTests/stress/regress-171079.js 2017-04-21 00:30:44 UTC (rev 215596)
@@ -0,0 +1,38 @@
+function assert(actual, expected) {
+ if (actual != expected)
+ throw("FAILED: actual " + actual + ", expected " + expected);
+}
+
+Object.defineProperty(this, "t0", {
+ get: function() {
+ "use strict";
+ return t2.subarray(4, 7);
+ }
+});
+
+t2 = new Uint16Array();
+
+var exception;
+function test() {
+ exception = void 0;
+ try {
+ return t0;
+ } catch (e) {
+ exception = e;
+ }
+}
+
+for (var i = 0; i < 100; ++i) {
+ test();
+ assert(exception, void 0);
+}
+
+t2.__proto__ = {
+ subarray: 1
+};
+
+test();
+assert(exception, "TypeError: t2.subarray is not a function. (In 't2.subarray(4, 7)', 't2.subarray' is 1)");
+
+test();
+assert(exception, "TypeError: t2.subarray is not a function. (In 't2.subarray(4, 7)', 't2.subarray' is 1)");
Modified: trunk/Source/_javascript_Core/ChangeLog (215595 => 215596)
--- trunk/Source/_javascript_Core/ChangeLog 2017-04-21 00:20:59 UTC (rev 215595)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-04-21 00:30:44 UTC (rev 215596)
@@ -1,5 +1,19 @@
2017-04-20 Mark Lam <[email protected]>
+ virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
+ https://bugs.webkit.org/show_bug.cgi?id=171079
+ <rdar://problem/31684756>
+
+ Reviewed by Saam Barati.
+
+ This is needed because tail calls would restore callee saved registers (and
+ therefore, potentially clobber the tag registers) before jumping to the thunk.
+
+ * jit/ThunkGenerators.cpp:
+ (JSC::virtualThunkFor):
+
+2017-04-20 Mark Lam <[email protected]>
+
Build fix after r215592.
https://bugs.webkit.org/show_bug.cgi?id=171088
Modified: trunk/Source/_javascript_Core/jit/ThunkGenerators.cpp (215595 => 215596)
--- trunk/Source/_javascript_Core/jit/ThunkGenerators.cpp 2017-04-21 00:20:59 UTC (rev 215595)
+++ trunk/Source/_javascript_Core/jit/ThunkGenerators.cpp 2017-04-21 00:30:44 UTC (rev 215596)
@@ -180,9 +180,16 @@
// the DFG knows that the value is definitely a cell, or definitely a function.
#if USE(JSVALUE64)
+ GPRReg tagMaskRegister = GPRInfo::tagMaskRegister;
+ if (callLinkInfo.isTailCall()) {
+ // Tail calls could have clobbered the GPRInfo::tagMaskRegister because they
+ // restore callee saved registers before getthing here. So, let's materialize
+ // the TagMask in a temp register and use the temp instead.
+ tagMaskRegister = GPRInfo::regT4;
+ jit.move(CCallHelpers::TrustedImm64(TagMask), tagMaskRegister);
+ }
slowCase.append(
- jit.branchTest64(
- CCallHelpers::NonZero, GPRInfo::regT0, GPRInfo::tagMaskRegister));
+ jit.branchTest64(CCallHelpers::NonZero, GPRInfo::regT0, tagMaskRegister));
#else
slowCase.append(
jit.branch32(
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
