Title: [179863] trunk/Source/_javascript_Core
- Revision
- 179863
- Author
- [email protected]
- Date
- 2015-02-09 20:46:53 -0800 (Mon, 09 Feb 2015)
Log Message
DFG::StackLayoutPhase should always set the scopeRegister to VirtualRegister() because the DFG doesn't do anything to make its value valid
https://bugs.webkit.org/show_bug.cgi?id=141412
Reviewed by Michael Saboff.
StackLayoutPhase was attempting to ensure that the register that
CodeBlock::scopeRegister() points to is the right one for the DFG. But the DFG did nothing
else to maintain the validity of the scopeRegister(). It wasn't captured as far as I can
tell. StackLayoutPhase didn't explicitly mark it live. PreciseLocalClobberize didn't mark
it as being live. So, by the time we got here the register referred to by
CodeBlock::scopeRegister() would have been junk. Moreover, CodeBlock::scopeRegister() was
not used for DFG code blocks, and was hardly ever used outside of bytecode generation.
So, this patch just removes the code to manipulate this field and replaces it with an
unconditional setScopeRegister(VirtualRegister()). Setting it to the invalid register
ensures that any attempst to read the scopeRegister in a DFG or FTL frame immediately
punts.
* dfg/DFGStackLayoutPhase.cpp:
(JSC::DFG::StackLayoutPhase::run):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (179862 => 179863)
--- trunk/Source/_javascript_Core/ChangeLog 2015-02-10 03:27:43 UTC (rev 179862)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-02-10 04:46:53 UTC (rev 179863)
@@ -1,5 +1,28 @@
2015-02-09 Filip Pizlo <[email protected]>
+ DFG::StackLayoutPhase should always set the scopeRegister to VirtualRegister() because the DFG doesn't do anything to make its value valid
+ https://bugs.webkit.org/show_bug.cgi?id=141412
+
+ Reviewed by Michael Saboff.
+
+ StackLayoutPhase was attempting to ensure that the register that
+ CodeBlock::scopeRegister() points to is the right one for the DFG. But the DFG did nothing
+ else to maintain the validity of the scopeRegister(). It wasn't captured as far as I can
+ tell. StackLayoutPhase didn't explicitly mark it live. PreciseLocalClobberize didn't mark
+ it as being live. So, by the time we got here the register referred to by
+ CodeBlock::scopeRegister() would have been junk. Moreover, CodeBlock::scopeRegister() was
+ not used for DFG code blocks, and was hardly ever used outside of bytecode generation.
+
+ So, this patch just removes the code to manipulate this field and replaces it with an
+ unconditional setScopeRegister(VirtualRegister()). Setting it to the invalid register
+ ensures that any attempst to read the scopeRegister in a DFG or FTL frame immediately
+ punts.
+
+ * dfg/DFGStackLayoutPhase.cpp:
+ (JSC::DFG::StackLayoutPhase::run):
+
+2015-02-09 Filip Pizlo <[email protected]>
+
Varargs frame set-up should be factored out for use by other JITs
https://bugs.webkit.org/show_bug.cgi?id=141388
Modified: trunk/Source/_javascript_Core/dfg/DFGStackLayoutPhase.cpp (179862 => 179863)
--- trunk/Source/_javascript_Core/dfg/DFGStackLayoutPhase.cpp 2015-02-10 03:27:43 UTC (rev 179862)
+++ trunk/Source/_javascript_Core/dfg/DFGStackLayoutPhase.cpp 2015-02-10 04:46:53 UTC (rev 179863)
@@ -168,10 +168,8 @@
virtualRegisterForLocal(allocation[codeBlock()->activationRegister().toLocal()]));
}
- if (codeBlock()->scopeRegister().isValid()) {
- unsigned scopeRegisterAllocation = allocation[codeBlock()->scopeRegister().toLocal()];
- codeBlock()->setScopeRegister(scopeRegisterAllocation == UINT_MAX ? VirtualRegister() : virtualRegisterForLocal(scopeRegisterAllocation));
- }
+ // This register is never valid for DFG code blocks.
+ codeBlock()->setScopeRegister(VirtualRegister());
for (unsigned i = m_graph.m_inlineVariableData.size(); i--;) {
InlineVariableData data = ""
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
