Title: [228073] branches/safari-605-branch
Revision
228073
Author
jmarc...@apple.com
Date
2018-02-04 21:30:44 -0800 (Sun, 04 Feb 2018)

Log Message

Cherry-pick r228031. rdar://problem/37220129

Modified Paths

Added Paths

Diff

Modified: branches/safari-605-branch/JSTests/ChangeLog (228072 => 228073)


--- branches/safari-605-branch/JSTests/ChangeLog	2018-02-05 05:30:42 UTC (rev 228072)
+++ branches/safari-605-branch/JSTests/ChangeLog	2018-02-05 05:30:44 UTC (rev 228073)
@@ -1,5 +1,23 @@
 2018-02-04  Jason Marcell  <jmarc...@apple.com>
 
+        Cherry-pick r228031. rdar://problem/37220129
+
+    2018-02-02  Saam Barati  <sbar...@apple.com>
+
+            When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
+            https://bugs.webkit.org/show_bug.cgi?id=182368
+            <rdar://problem/36932466>
+
+            Reviewed by Mark Lam.
+
+            * stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js: Added.
+            (runNearStackLimit.t):
+            (runNearStackLimit):
+            (try.runNearStackLimit):
+            (catch):
+
+2018-02-04  Jason Marcell  <jmarc...@apple.com>
+
         Cherry-pick r227998. rdar://problem/37220126
 
     2018-02-01  Mark Lam  <mark....@apple.com>

Added: branches/safari-605-branch/JSTests/stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js (0 => 228073)


--- branches/safari-605-branch/JSTests/stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js	                        (rev 0)
+++ branches/safari-605-branch/JSTests/stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js	2018-02-05 05:30:44 UTC (rev 228073)
@@ -0,0 +1,32 @@
+//@ runDefault("--useConcurrentGC=0", "--thresholdForJITAfterWarmUp=10", "--thresholdForJITSoon=10", "--thresholdForOptimizeAfterWarmUp=20", "--thresholdForOptimizeAfterLongWarmUp=20", "--thresholdForOptimizeSoon=20", "--thresholdForFTLOptimizeAfterWarmUp=20", "--thresholdForFTLOptimizeSoon=20", "--maximumEvalCacheableSourceLength=150000", "--maxPerThreadStackUsage=1048576")
+
+function runNearStackLimit(f) {
+    function t() {
+        try {
+            return t();
+        } catch (e) {
+            return f();
+        }
+    }
+    return t();
+};
+
+runNearStackLimit(() => { });
+runNearStackLimit(() => { });
+
+function f2(a, b) {
+    'use strict';
+    try {
+        a.push(arguments[0] + arguments[2] + a + undefinedVariable);
+    } catch (e) { }
+}
+
+try {
+    runNearStackLimit(() => {
+        return f2(1, 2, 3);
+    });
+} catch (e) {}
+
+try {
+    runNearStackLimit();
+} catch { }

Modified: branches/safari-605-branch/Source/_javascript_Core/ChangeLog (228072 => 228073)


--- branches/safari-605-branch/Source/_javascript_Core/ChangeLog	2018-02-05 05:30:42 UTC (rev 228072)
+++ branches/safari-605-branch/Source/_javascript_Core/ChangeLog	2018-02-05 05:30:44 UTC (rev 228073)
@@ -1,5 +1,31 @@
 2018-02-04  Jason Marcell  <jmarc...@apple.com>
 
+        Cherry-pick r228031. rdar://problem/37220129
+
+    2018-02-02  Saam Barati  <sbar...@apple.com>
+
+            When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
+            https://bugs.webkit.org/show_bug.cgi?id=182368
+            <rdar://problem/36932466>
+
+            Reviewed by Mark Lam.
+
+            When preserving liveness when inserting Unreachable nodes after ForceOSRExit,
+            we must add the VariableAccessData to the given argument position. Otherwise,
+            we may end up with a VariableAccessData that doesn't respect the shouldNeverUnbox bit.
+            If we end up with such a situation, it can lead to invalid IR after the
+            arguments elimination phase optimizes a GetByVal to a GetStack.
+
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::flushImpl):
+            (JSC::DFG::ByteCodeParser::flushForTerminalImpl):
+            (JSC::DFG::ByteCodeParser::flush):
+            (JSC::DFG::ByteCodeParser::flushForTerminal):
+            (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+            (JSC::DFG::ByteCodeParser::parse):
+
+2018-02-04  Jason Marcell  <jmarc...@apple.com>
+
         Cherry-pick r227998. rdar://problem/37220126
 
     2018-02-01  Mark Lam  <mark....@apple.com>

Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (228072 => 228073)


--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp	2018-02-05 05:30:42 UTC (rev 228072)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp	2018-02-05 05:30:44 UTC (rev 228073)
@@ -525,17 +525,17 @@
             ASSERT(!m_graph.hasDebuggerEnabled());
             numArguments = inlineCallFrame->argumentsWithFixup.size();
             if (inlineCallFrame->isClosureCall)
-                addFlushDirect(remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::callee)));
+                addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::callee)));
             if (inlineCallFrame->isVarargs())
-                addFlushDirect(remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::argumentCount)));
+                addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::argumentCount)));
         } else
             numArguments = m_graph.baselineCodeBlockFor(inlineCallFrame)->numParameters();
 
         for (unsigned argument = numArguments; argument--;)
-            addFlushDirect(remapOperand(inlineCallFrame, virtualRegisterForArgument(argument)));
+            addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, virtualRegisterForArgument(argument)));
 
         if (m_graph.needsScopeRegister())
-            addFlushDirect(m_graph.m_codeBlock->scopeRegister());
+            addFlushDirect(nullptr, m_graph.m_codeBlock->scopeRegister());
     }
 
     template<typename AddFlushDirectFunc, typename AddPhantomLocalDirectFunc>
@@ -553,7 +553,7 @@
 
                 for (unsigned local = codeBlock->m_numCalleeLocals; local--;) {
                     if (livenessAtBytecode[local])
-                        addPhantomLocalDirect(remapOperand(inlineCallFrame, virtualRegisterForLocal(local)));
+                        addPhantomLocalDirect(inlineCallFrame, remapOperand(inlineCallFrame, virtualRegisterForLocal(local)));
                 }
             });
     }
@@ -600,14 +600,14 @@
 
     void flush(InlineStackEntry* inlineStackEntry)
     {
-        auto addFlushDirect = [&] (VirtualRegister reg) { flushDirect(reg); };
+        auto addFlushDirect = [&] (InlineCallFrame*, VirtualRegister reg) { flushDirect(reg); };
         flushImpl(inlineStackEntry->m_inlineCallFrame, addFlushDirect);
     }
 
     void flushForTerminal()
     {
-        auto addFlushDirect = [&] (VirtualRegister reg) { flushDirect(reg); };
-        auto addPhantomLocalDirect = [&] (VirtualRegister reg) { phantomLocalDirect(reg); };
+        auto addFlushDirect = [&] (InlineCallFrame*, VirtualRegister reg) { flushDirect(reg); };
+        auto addPhantomLocalDirect = [&] (InlineCallFrame*, VirtualRegister reg) { phantomLocalDirect(reg); };
         flushForTerminalImpl(currentCodeOrigin(), addFlushDirect, addPhantomLocalDirect);
     }
 
@@ -1026,6 +1026,8 @@
     FrozenValue* m_constantOne;
     Vector<Node*, 16> m_constants;
 
+    HashMap<InlineCallFrame*, Vector<ArgumentPosition*>, WTF::DefaultHash<InlineCallFrame*>::Hash, WTF::NullableHashTraits<InlineCallFrame*>> m_inlineCallFrameToArgumentPositions;
+
     // The number of arguments passed to the function.
     unsigned m_numArguments;
     // The number of locals (vars + temporaries) used in the function.
@@ -6398,13 +6400,7 @@
     }
     
     int argumentCountIncludingThisWithFixup = std::max<int>(argumentCountIncludingThis, codeBlock->numParameters());
-    m_argumentPositions.resize(argumentCountIncludingThisWithFixup);
-    for (int i = 0; i < argumentCountIncludingThisWithFixup; ++i) {
-        byteCodeParser->m_graph.m_argumentPositions.append(ArgumentPosition());
-        ArgumentPosition* argumentPosition = &byteCodeParser->m_graph.m_argumentPositions.last();
-        m_argumentPositions[i] = argumentPosition;
-    }
-    
+
     if (m_caller) {
         // Inline case.
         ASSERT(codeBlock != byteCodeParser->m_codeBlock);
@@ -6455,6 +6451,14 @@
             m_switchRemap[i] = i;
     }
     
+    m_argumentPositions.resize(argumentCountIncludingThisWithFixup);
+    for (int i = 0; i < argumentCountIncludingThisWithFixup; ++i) {
+        byteCodeParser->m_graph.m_argumentPositions.append(ArgumentPosition());
+        ArgumentPosition* argumentPosition = &byteCodeParser->m_graph.m_argumentPositions.last();
+        m_argumentPositions[i] = argumentPosition;
+    }
+    byteCodeParser->m_inlineCallFrameToArgumentPositions.add(m_inlineCallFrame, m_argumentPositions);
+    
     byteCodeParser->m_inlineStackTop = this;
 }
 
@@ -6605,17 +6609,27 @@
 
                     insertionSet.insertNode(block->size(), SpecNone, ExitOK, endOrigin);
 
-                    auto insertLivenessPreservingOp = [&] (NodeType op, VirtualRegister operand) {
+                    auto insertLivenessPreservingOp = [&] (InlineCallFrame* inlineCallFrame, NodeType op, VirtualRegister operand) {
                         VariableAccessData* variable = mapping.operand(operand);
                         if (!variable) {
                             variable = newVariableAccessData(operand);
                             mapping.operand(operand) = variable;
                         }
+
+                        VirtualRegister argument = operand - (inlineCallFrame ? inlineCallFrame->stackOffset : 0);
+                        if (argument.isArgument() && !argument.isHeader()) {
+                            const Vector<ArgumentPosition*>& arguments = m_inlineCallFrameToArgumentPositions.get(inlineCallFrame);
+                            arguments[argument.toArgument()]->addVariable(variable);
+                        }
+
                         insertionSet.insertNode(block->size(), SpecNone, op, endOrigin, OpInfo(variable));
                     };
-                    auto addFlushDirect = [&] (VirtualRegister operand) { insertLivenessPreservingOp(Flush, operand); };
-                    auto addPhantomLocalDirect = [&] (VirtualRegister operand) { insertLivenessPreservingOp(PhantomLocal, operand); };
-
+                    auto addFlushDirect = [&] (InlineCallFrame* inlineCallFrame, VirtualRegister operand) {
+                        insertLivenessPreservingOp(inlineCallFrame, Flush, operand);
+                    };
+                    auto addPhantomLocalDirect = [&] (InlineCallFrame* inlineCallFrame, VirtualRegister operand) {
+                        insertLivenessPreservingOp(inlineCallFrame, PhantomLocal, operand);
+                    };
                     flushForTerminalImpl(endOrigin.semantic, addFlushDirect, addPhantomLocalDirect);
 
                     insertionSet.insertNode(block->size(), SpecNone, Unreachable, endOrigin);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to