[webkit-changes] [199052] trunk/Source/JavaScriptCore

Mon, 04 Apr 2016 23:30:17 -0700

Title: [199052] trunk/Source/_javascript_Core
Revision
199052
Author
[email protected]
Date
2016-04-04 23:30:02 -0700 (Mon, 04 Apr 2016)

Log Message

Add missing EABI_32BIT_DUMMY_ARG arguments for some callOperation(J_JITOperation_EGReoJ, ...) overloads
https://bugs.webkit.org/show_bug.cgi?id=156161

Reviewed by Yusuke Suzuki.

r197641 added a couple of callOperation(J_JITOperation_EGReoJ, ...) overloads
that handle arguments split into the tag and the payload. The two were split
between the last argument register and the stack on 32-bit ARM EABI systems,
causing incorrect behavior.

Adding EABI_32BIT_DUMMY_ARG pushes the tag and payload together onto the
stack, removing the issue.

* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (199051 => 199052)


--- trunk/Source/_javascript_Core/ChangeLog	2016-04-05 06:18:48 UTC (rev 199051)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-04-05 06:30:02 UTC (rev 199052)
@@ -1,3 +1,21 @@
+2016-04-04  Zan Dobersek  <[email protected]>
+
+        Add missing EABI_32BIT_DUMMY_ARG arguments for some callOperation(J_JITOperation_EGReoJ, ...) overloads
+        https://bugs.webkit.org/show_bug.cgi?id=156161
+
+        Reviewed by Yusuke Suzuki.
+
+        r197641 added a couple of callOperation(J_JITOperation_EGReoJ, ...) overloads
+        that handle arguments split into the tag and the payload. The two were split
+        between the last argument register and the stack on 32-bit ARM EABI systems,
+        causing incorrect behavior.
+
+        Adding EABI_32BIT_DUMMY_ARG pushes the tag and payload together onto the
+        stack, removing the issue.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
 2016-04-04  Joseph Pecoraro  <[email protected]>
 
         Avoid copying ModuleLoaderObject.js to resources bundle

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (199051 => 199052)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2016-04-05 06:18:48 UTC (rev 199051)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2016-04-05 06:30:02 UTC (rev 199052)
@@ -1739,7 +1739,7 @@
     }
     JITCompiler::Call callOperation(J_JITOperation_EGReoJ operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2, GPRReg arg3Tag, GPRReg arg3Payload)
     {
-        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3Payload, arg3Tag);
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3Payload, arg3Tag);
         return appendCallSetResult(operation, resultPayload, resultTag);
     }
     JITCompiler::Call callOperation(J_JITOperation_EGReoJss operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2, GPRReg arg3)
@@ -1851,7 +1851,7 @@
     }
     JITCompiler::Call callOperation(S_JITOperation_EGReoJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3Tag, GPRReg arg3Payload)
     {
-        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3Payload, arg3Tag);
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3Payload, arg3Tag);
         return appendCallSetResult(operation, result);
     }
     JITCompiler::Call callOperation(S_JITOperation_EGReoJss operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to