Changeset 188883 in webkit

Timestamp:

Aug 24, 2015 2:41:37 PM (9 years ago)

Author:

basile_clement@apple.com

Message:

jsc-tailcall: We can't assert that registers are flushed when making a tail call
​https://bugs.webkit.org/show_bug.cgi?id=148396

Reviewed by Michael Saboff.

We should be able to assert that registers are flushed when making a
tail call, since no additional code should ever be executed after the
tail call. However, because we can have Phantom() nodes keeping values
alive across a tail call, this assertion can (and does) fail in some
cases - even though those nodes are dead nodes that will not actually
generate any code. So we can't have the assertion.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

Location:

branches/jsc-tailcall/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)

branches/jsc-tailcall/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-08-24  Basile Clement  <basile_clement@apple.com>
+
+        jsc-tailcall: We can't assert that registers are flushed when making a tail call
+        https://bugs.webkit.org/show_bug.cgi?id=148396
+
+        Reviewed by Michael Saboff.
+
+        We should be able to assert that registers are flushed when making a
+        tail call, since no additional code should ever be executed after the
+        tail call. However, because we can have Phantom() nodes keeping values
+        alive across a tail call, this assertion can (and does) fail in some
+        cases - even though those nodes are dead nodes that will not actually
+        generate any code. So we can't have the assertion.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
 2015-08-24  Basile Clement  <basile_clement@apple.com>
 

branches/jsc-tailcall/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -820 +820 @@
     // the callee frame.
     // https://bugs.webkit.org/show_bug.cgi?id=147508
-    if (isTail)
-        ASSERT(isFlushed());
-    else
+    if (!isTail)
         flushRegisters();
 

branches/jsc-tailcall/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -797 +797 @@
     // the callee frame.
     // https://bugs.webkit.org/show_bug.cgi?id=147508
-    if (isTail)
-        ASSERT(isFlushed());
-    else
+    if (!isTail)
         flushRegisters();