Changeset 228073 in webkit

Timestamp:

Feb 4, 2018 9:30:44 PM (6 years ago)

Author:

jmarcell@apple.com

Message:

Cherry-pick r228031. rdar://problem/37220129

Location:

branches/safari-605-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (9 diffs)

branches/safari-605-branch/JSTests/ChangeLog

@@ +1 @@
+2018-02-04  Jason Marcell  <jmarcell@apple.com>
+
+        Cherry-pick r228031. rdar://problem/37220129
+
+    2018-02-02  Saam Barati  <sbarati@apple.com>
+
+            When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
+            https://bugs.webkit.org/show_bug.cgi?id=182368
+            <rdar://problem/36932466>
+
+            Reviewed by Mark Lam.
+
+            * stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js: Added.
+            (runNearStackLimit.t):
+            (runNearStackLimit):
+            (try.runNearStackLimit):
+            (catch):
+
 2018-02-04  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-605-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-02-04  Jason Marcell  <jmarcell@apple.com>
+
+        Cherry-pick r228031. rdar://problem/37220129
+
+    2018-02-02  Saam Barati  <sbarati@apple.com>
+
+            When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
+            https://bugs.webkit.org/show_bug.cgi?id=182368
+            <rdar://problem/36932466>
+
+            Reviewed by Mark Lam.
+
+            When preserving liveness when inserting Unreachable nodes after ForceOSRExit,
+            we must add the VariableAccessData to the given argument position. Otherwise,
+            we may end up with a VariableAccessData that doesn't respect the shouldNeverUnbox bit.
+            If we end up with such a situation, it can lead to invalid IR after the
+            arguments elimination phase optimizes a GetByVal to a GetStack.
+
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::flushImpl):
+            (JSC::DFG::ByteCodeParser::flushForTerminalImpl):
+            (JSC::DFG::ByteCodeParser::flush):
+            (JSC::DFG::ByteCodeParser::flushForTerminal):
+            (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+            (JSC::DFG::ByteCodeParser::parse):
+
 2018-02-04  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-605-branch/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -526 +526 @@
             numArguments = inlineCallFrame->argumentsWithFixup.size();
             if (inlineCallFrame->isClosureCall)
-                addFlushDirect(remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::callee)));
+                addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::callee)));
             if (inlineCallFrame->isVarargs())
-                addFlushDirect(remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::argumentCount)));
+                addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, VirtualRegister(CallFrameSlot::argumentCount)));
         } else
             numArguments = m_graph.baselineCodeBlockFor(inlineCallFrame)->numParameters();
 
         for (unsigned argument = numArguments; argument--;)
-            addFlushDirect(remapOperand(inlineCallFrame, virtualRegisterForArgument(argument)));
+            addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, virtualRegisterForArgument(argument)));
 
         if (m_graph.needsScopeRegister())
-            addFlushDirect(m_graph.m_codeBlock->scopeRegister());
+            addFlushDirect(nullptr, m_graph.m_codeBlock->scopeRegister());
     }
 
@@ -554 +554 @@
                 for (unsigned local = codeBlock->m_numCalleeLocals; local--;) {
                     if (livenessAtBytecode[local])
-                        addPhantomLocalDirect(remapOperand(inlineCallFrame, virtualRegisterForLocal(local)));
+                        addPhantomLocalDirect(inlineCallFrame, remapOperand(inlineCallFrame, virtualRegisterForLocal(local)));
                 }
             });
@@ -601 +601 @@
     void flush(InlineStackEntry* inlineStackEntry)
     {
-        auto addFlushDirect = [&] (VirtualRegister reg) { flushDirect(reg); };
+        auto addFlushDirect = [&] (InlineCallFrame*, VirtualRegister reg) { flushDirect(reg); };
         flushImpl(inlineStackEntry->m_inlineCallFrame, addFlushDirect);
     }
@@ -607 +607 @@
     void flushForTerminal()
     {
-        auto addFlushDirect = [&] (VirtualRegister reg) { flushDirect(reg); };
-        auto addPhantomLocalDirect = [&] (VirtualRegister reg) { phantomLocalDirect(reg); };
+        auto addFlushDirect = [&] (InlineCallFrame*, VirtualRegister reg) { flushDirect(reg); };
+        auto addPhantomLocalDirect = [&] (InlineCallFrame*, VirtualRegister reg) { phantomLocalDirect(reg); };
         flushForTerminalImpl(currentCodeOrigin(), addFlushDirect, addPhantomLocalDirect);
     }
@@ -1026 +1026 @@
     FrozenValue* m_constantOne;
     Vector<Node*, 16> m_constants;
+
+    HashMap<InlineCallFrame*, Vector<ArgumentPosition*>, WTF::DefaultHash<InlineCallFrame*>::Hash, WTF::NullableHashTraits<InlineCallFrame*>> m_inlineCallFrameToArgumentPositions;
 
     // The number of arguments passed to the function.
@@ -6399 +6401 @@
     
     int argumentCountIncludingThisWithFixup = std::max<int>(argumentCountIncludingThis, codeBlock->numParameters());
-    m_argumentPositions.resize(argumentCountIncludingThisWithFixup);
-    for (int i = 0; i < argumentCountIncludingThisWithFixup; ++i) {
-        byteCodeParser->m_graph.m_argumentPositions.append(ArgumentPosition());
-        ArgumentPosition* argumentPosition = &byteCodeParser->m_graph.m_argumentPositions.last();
-        m_argumentPositions[i] = argumentPosition;
-    }
-    
+
     if (m_caller) {
         // Inline case.
@@ -6456 +6452 @@
     }
     
+    m_argumentPositions.resize(argumentCountIncludingThisWithFixup);
+    for (int i = 0; i < argumentCountIncludingThisWithFixup; ++i) {
+        byteCodeParser->m_graph.m_argumentPositions.append(ArgumentPosition());
+        ArgumentPosition* argumentPosition = &byteCodeParser->m_graph.m_argumentPositions.last();
+        m_argumentPositions[i] = argumentPosition;
+    }
+    byteCodeParser->m_inlineCallFrameToArgumentPositions.add(m_inlineCallFrame, m_argumentPositions);
+    
     byteCodeParser->m_inlineStackTop = this;
 }
@@ -6606 +6610 @@
                     insertionSet.insertNode(block->size(), SpecNone, ExitOK, endOrigin);
 
-                    auto insertLivenessPreservingOp = [&] (NodeType op, VirtualRegister operand) {
+                    auto insertLivenessPreservingOp = [&] (InlineCallFrame* inlineCallFrame, NodeType op, VirtualRegister operand) {
                         VariableAccessData* variable = mapping.operand(operand);
                         if (!variable) {
@@ -6612 +6616 @@
                             mapping.operand(operand) = variable;
                         }
+
+                        VirtualRegister argument = operand - (inlineCallFrame ? inlineCallFrame->stackOffset : 0);
+                        if (argument.isArgument() && !argument.isHeader()) {
+                            const Vector<ArgumentPosition*>& arguments = m_inlineCallFrameToArgumentPositions.get(inlineCallFrame);
+                            arguments[argument.toArgument()]->addVariable(variable);
+                        }
+
                         insertionSet.insertNode(block->size(), SpecNone, op, endOrigin, OpInfo(variable));
                     };
-                    auto addFlushDirect = [&] (VirtualRegister operand) { insertLivenessPreservingOp(Flush, operand); };
-                    auto addPhantomLocalDirect = [&] (VirtualRegister operand) { insertLivenessPreservingOp(PhantomLocal, operand); };
-
+                    auto addFlushDirect = [&] (InlineCallFrame* inlineCallFrame, VirtualRegister operand) {
+                        insertLivenessPreservingOp(inlineCallFrame, Flush, operand);
+                    };
+                    auto addPhantomLocalDirect = [&] (InlineCallFrame* inlineCallFrame, VirtualRegister operand) {
+                        insertLivenessPreservingOp(inlineCallFrame, PhantomLocal, operand);
+                    };
                     flushForTerminalImpl(endOrigin.semantic, addFlushDirect, addPhantomLocalDirect);