Changeset 155399 in webkit

Timestamp:

Sep 9, 2013, 4:03:19 PM (13 years ago)

Author:

msaboff@apple.com

Message:

Wrong for SlowPathCall to load callFrame reg from vm.topCallFrame after call
​https://bugs.webkit.org/show_bug.cgi?id=120537

Reviewed by Geoffrey Garen.

Changed JITSlowPathCall::call() to update vm.topCallFrame from the callFrameRegister instead of the
other way around.

• jit/JIT.h:
• jit/JITInlines.h:
• jit/SlowPathCall.h:

(JSC::JITSlowPathCall::call):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JIT.h (modified) (1 diff)
• jit/JITInlines.h (modified) (1 diff)
• jit/SlowPathCall.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-09-09  Michael Saboff  <msaboff@apple.com>
+
+        Wrong for SlowPathCall to load callFrame reg from vm.topCallFrame after call
+        https://bugs.webkit.org/show_bug.cgi?id=120537
+
+        Reviewed by Geoffrey Garen.
+
+        Changed JITSlowPathCall::call() to update vm.topCallFrame from the callFrameRegister instead of the
+        other way around.
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+
 2013-08-29  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/JavaScriptCore/jit/JIT.h

@@ -839 +839 @@
         void restoreArgumentReferenceForTrampoline();
         void updateTopCallFrame();
-        void reloadCallFrameFromTopCallFrame();
 
         Call emitNakedCall(CodePtr function = CodePtr());

trunk/Source/JavaScriptCore/jit/JITInlines.h

@@ -192 +192 @@
 }
 
-ALWAYS_INLINE void JIT::reloadCallFrameFromTopCallFrame()
-{
-    loadPtr(&m_vm->topCallFrame, callFrameRegister);
-}
-
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {

trunk/Source/JavaScriptCore/jit/SlowPathCall.h

@@ -89 +89 @@
         JIT::Jump noException = m_jit->branchTest64(JIT::Zero, JIT::AbsoluteAddress(m_jit->m_codeBlock->vm()->addressOfException()));
 #endif
-        m_jit->reloadCallFrameFromTopCallFrame();
+        m_jit->updateTopCallFrame();
         m_jit->move(JIT::TrustedImmPtr(FunctionPtr(ctiVMHandleException).value()), JIT::regT1);
         m_jit->jump(JIT::regT1);