Title: [155399] trunk/Source/_javascript_Core
- Revision
- 155399
- Author
- [email protected]
- Date
- 2013-09-09 16:03:19 -0700 (Mon, 09 Sep 2013)
Log Message
Wrong for SlowPathCall to load callFrame reg from vm.topCallFrame after call
https://bugs.webkit.org/show_bug.cgi?id=120537
Reviewed by Geoffrey Garen.
Changed JITSlowPathCall::call() to update vm.topCallFrame from the callFrameRegister instead of the
other way around.
* jit/JIT.h:
* jit/JITInlines.h:
* jit/SlowPathCall.h:
(JSC::JITSlowPathCall::call):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (155398 => 155399)
--- trunk/Source/_javascript_Core/ChangeLog 2013-09-09 23:02:39 UTC (rev 155398)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-09-09 23:03:19 UTC (rev 155399)
@@ -1,3 +1,18 @@
+2013-09-09 Michael Saboff <[email protected]>
+
+ Wrong for SlowPathCall to load callFrame reg from vm.topCallFrame after call
+ https://bugs.webkit.org/show_bug.cgi?id=120537
+
+ Reviewed by Geoffrey Garen.
+
+ Changed JITSlowPathCall::call() to update vm.topCallFrame from the callFrameRegister instead of the
+ other way around.
+
+ * jit/JIT.h:
+ * jit/JITInlines.h:
+ * jit/SlowPathCall.h:
+ (JSC::JITSlowPathCall::call):
+
2013-08-29 Mark Hahnenberg <[email protected]>
JSArray::shiftCountWithArrayStorage doesn't change indexBias when shifting the last element in m_vector
Modified: trunk/Source/_javascript_Core/jit/JIT.h (155398 => 155399)
--- trunk/Source/_javascript_Core/jit/JIT.h 2013-09-09 23:02:39 UTC (rev 155398)
+++ trunk/Source/_javascript_Core/jit/JIT.h 2013-09-09 23:03:19 UTC (rev 155399)
@@ -838,7 +838,6 @@
void restoreArgumentReferenceForTrampoline();
void updateTopCallFrame();
- void reloadCallFrameFromTopCallFrame();
Call emitNakedCall(CodePtr function = CodePtr());
Modified: trunk/Source/_javascript_Core/jit/JITInlines.h (155398 => 155399)
--- trunk/Source/_javascript_Core/jit/JITInlines.h 2013-09-09 23:02:39 UTC (rev 155398)
+++ trunk/Source/_javascript_Core/jit/JITInlines.h 2013-09-09 23:03:19 UTC (rev 155399)
@@ -191,11 +191,6 @@
storePtr(callFrameRegister, &m_vm->topCallFrame);
}
-ALWAYS_INLINE void JIT::reloadCallFrameFromTopCallFrame()
-{
- loadPtr(&m_vm->topCallFrame, callFrameRegister);
-}
-
ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
{
#if CPU(X86)
Modified: trunk/Source/_javascript_Core/jit/SlowPathCall.h (155398 => 155399)
--- trunk/Source/_javascript_Core/jit/SlowPathCall.h 2013-09-09 23:02:39 UTC (rev 155398)
+++ trunk/Source/_javascript_Core/jit/SlowPathCall.h 2013-09-09 23:03:19 UTC (rev 155399)
@@ -88,7 +88,7 @@
#else
JIT::Jump noException = m_jit->branchTest64(JIT::Zero, JIT::AbsoluteAddress(m_jit->m_codeBlock->vm()->addressOfException()));
#endif
- m_jit->reloadCallFrameFromTopCallFrame();
+ m_jit->updateTopCallFrame();
m_jit->move(JIT::TrustedImmPtr(FunctionPtr(ctiVMHandleException).value()), JIT::regT1);
m_jit->jump(JIT::regT1);
noException.link(m_jit);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
