Title: [219809] releases/WebKitGTK/webkit-2.16
- Revision
- 219809
- Author
- [email protected]
- Date
- 2017-07-24 03:49:23 -0700 (Mon, 24 Jul 2017)
Log Message
Merge r215596 - virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
https://bugs.webkit.org/show_bug.cgi?id=171079
<rdar://problem/31684756>
Reviewed by Saam Barati.
JSTests:
* stress/regress-171079.js: Added.
Source/_javascript_Core:
This is needed because tail calls would restore callee saved registers (and
therefore, potentially clobber the tag registers) before jumping to the thunk.
* jit/ThunkGenerators.cpp:
(JSC::virtualThunkFor):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.16/JSTests/ChangeLog (219808 => 219809)
--- releases/WebKitGTK/webkit-2.16/JSTests/ChangeLog 2017-07-24 10:48:18 UTC (rev 219808)
+++ releases/WebKitGTK/webkit-2.16/JSTests/ChangeLog 2017-07-24 10:49:23 UTC (rev 219809)
@@ -1,3 +1,13 @@
+2017-04-20 Mark Lam <[email protected]>
+
+ virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
+ https://bugs.webkit.org/show_bug.cgi?id=171079
+ <rdar://problem/31684756>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-171079.js: Added.
+
2017-05-05 Saam Barati <[email protected]>
putDirectIndex does not properly do defineOwnProperty
Added: releases/WebKitGTK/webkit-2.16/JSTests/stress/regress-171079.js (0 => 219809)
--- releases/WebKitGTK/webkit-2.16/JSTests/stress/regress-171079.js (rev 0)
+++ releases/WebKitGTK/webkit-2.16/JSTests/stress/regress-171079.js 2017-07-24 10:49:23 UTC (rev 219809)
@@ -0,0 +1,38 @@
+function assert(actual, expected) {
+ if (actual != expected)
+ throw("FAILED: actual " + actual + ", expected " + expected);
+}
+
+Object.defineProperty(this, "t0", {
+ get: function() {
+ "use strict";
+ return t2.subarray(4, 7);
+ }
+});
+
+t2 = new Uint16Array();
+
+var exception;
+function test() {
+ exception = void 0;
+ try {
+ return t0;
+ } catch (e) {
+ exception = e;
+ }
+}
+
+for (var i = 0; i < 100; ++i) {
+ test();
+ assert(exception, void 0);
+}
+
+t2.__proto__ = {
+ subarray: 1
+};
+
+test();
+assert(exception, "TypeError: t2.subarray is not a function. (In 't2.subarray(4, 7)', 't2.subarray' is 1)");
+
+test();
+assert(exception, "TypeError: t2.subarray is not a function. (In 't2.subarray(4, 7)', 't2.subarray' is 1)");
Modified: releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/ChangeLog (219808 => 219809)
--- releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/ChangeLog 2017-07-24 10:48:18 UTC (rev 219808)
+++ releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/ChangeLog 2017-07-24 10:49:23 UTC (rev 219809)
@@ -1,3 +1,17 @@
+2017-04-20 Mark Lam <[email protected]>
+
+ virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
+ https://bugs.webkit.org/show_bug.cgi?id=171079
+ <rdar://problem/31684756>
+
+ Reviewed by Saam Barati.
+
+ This is needed because tail calls would restore callee saved registers (and
+ therefore, potentially clobber the tag registers) before jumping to the thunk.
+
+ * jit/ThunkGenerators.cpp:
+ (JSC::virtualThunkFor):
+
2017-05-05 Keith Miller <[email protected]>
Put does not properly consult the prototype chain
Modified: releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/jit/ThunkGenerators.cpp (219808 => 219809)
--- releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/jit/ThunkGenerators.cpp 2017-07-24 10:48:18 UTC (rev 219808)
+++ releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/jit/ThunkGenerators.cpp 2017-07-24 10:49:23 UTC (rev 219809)
@@ -183,9 +183,16 @@
// the DFG knows that the value is definitely a cell, or definitely a function.
#if USE(JSVALUE64)
+ GPRReg tagMaskRegister = GPRInfo::tagMaskRegister;
+ if (callLinkInfo.isTailCall()) {
+ // Tail calls could have clobbered the GPRInfo::tagMaskRegister because they
+ // restore callee saved registers before getthing here. So, let's materialize
+ // the TagMask in a temp register and use the temp instead.
+ tagMaskRegister = GPRInfo::regT4;
+ jit.move(CCallHelpers::TrustedImm64(TagMask), tagMaskRegister);
+ }
slowCase.append(
- jit.branchTest64(
- CCallHelpers::NonZero, GPRInfo::regT0, GPRInfo::tagMaskRegister));
+ jit.branchTest64(CCallHelpers::NonZero, GPRInfo::regT0, tagMaskRegister));
#else
slowCase.append(
jit.branch32(
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
