Changeset 244783 in webkit

Timestamp:

Apr 30, 2019, 10:57:48 AM (7 years ago)

Author:

keith_miller@apple.com

Message:

Fix failing ARM64E wasm tests
​https://bugs.webkit.org/show_bug.cgi?id=197420

Reviewed by Saam Barati.

This patch fixes a bug in the slow path of our JS->Wasm IC bridge
where we wouldn't untag the link register before tail calling.

Additionally, this patch fixes a broken assert when using setting
Options::useTailCalls=false.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitCallForwardArgumentsInTailPosition):

• wasm/js/WebAssemblyFunction.cpp:

(JSC::WebAssemblyFunction::jsCallEntrypointSlow):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecompiler/BytecodeGenerator.cpp (modified) (1 diff)
• wasm/js/WebAssemblyFunction.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-04-30  Keith Miller  <keith_miller@apple.com>
+
+        Fix failing ARM64E wasm tests
+        https://bugs.webkit.org/show_bug.cgi?id=197420
+
+        Reviewed by Saam Barati.
+
+        This patch fixes a bug in the slow path of our JS->Wasm IC bridge
+        where we wouldn't untag the link register before tail calling.
+
+        Additionally, this patch fixes a broken assert when using setting
+        Options::useTailCalls=false.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallForwardArgumentsInTailPosition):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
+
 2019-04-29  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -3286 +3286 @@
 RegisterID* BytecodeGenerator::emitCallForwardArgumentsInTailPosition(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
 {
-    ASSERT(m_inTailPosition);
+    // We must emit a tail call here because we did not allocate an arguments object thus we would otherwise have no way to correctly make this call.
+    ASSERT(m_inTailPosition || !Options::useTailCalls());
     return emitCallVarargs<OpTailCallForwardArguments>(dst, func, thisRegister, nullptr, firstFreeRegister, firstVarArgOffset, divot, divotStart, divotEnd, debuggableCall);
 }

trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp

@@ -471 +471 @@
     jit.move(CCallHelpers::TrustedImmPtr(this), GPRInfo::regT0);
     jit.emitFunctionEpilogue();
+#if CPU(ARM64E)
+    jit.untagPtr(MacroAssembler::linkRegister, MacroAssembler::stackPointerRegister);
+#endif
     auto jumpToHostCallThunk = jit.jump();