Changeset 244865 in webkit

Timestamp:

May 1, 2019, 8:10:43 PM (7 years ago)

Author:

sbarati@apple.com

Message:

Baseline JIT should do argument value profiling after checking for stack overflow
​https://bugs.webkit.org/show_bug.cgi?id=197052
<rdar://problem/50009602>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/check-stack-overflow-before-value-profiling-arguments.js: Added.

Source/JavaScriptCore:

Otherwise, we may do value profiling without running a write barrier, which
is against the rules of how we do value profiling.

• jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/check-stack-overflow-before-value-profiling-arguments.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jit/JIT.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-05-01  Saam barati  <sbarati@apple.com>
+
+        Baseline JIT should do argument value profiling after checking for stack overflow
+        https://bugs.webkit.org/show_bug.cgi?id=197052
+        <rdar://problem/50009602>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/check-stack-overflow-before-value-profiling-arguments.js: Added.
+
 2019-05-01  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-01  Saam barati  <sbarati@apple.com>
+
+        Baseline JIT should do argument value profiling after checking for stack overflow
+        https://bugs.webkit.org/show_bug.cgi?id=197052
+        <rdar://problem/50009602>
+
+        Reviewed by Yusuke Suzuki.
+
+        Otherwise, we may do value profiling without running a write barrier, which
+        is against the rules of how we do value profiling.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+
 2019-05-01  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/jit/JIT.cpp

@@ -682 +682 @@
 #endif
 
+    int frameTopOffset = stackPointerOffsetFor(m_codeBlock) * sizeof(Register);
+    unsigned maxFrameSize = -frameTopOffset;
+    addPtr(TrustedImm32(frameTopOffset), callFrameRegister, regT1);
+    JumpList stackOverflow;
+    if (UNLIKELY(maxFrameSize > Options::reservedZoneSize()))
+        stackOverflow.append(branchPtr(Above, regT1, callFrameRegister));
+    stackOverflow.append(branchPtr(Above, AbsoluteAddress(m_vm->addressOfSoftStackLimit()), regT1));
+
+    move(regT1, stackPointerRegister);
+    checkStackPointerAlignment();
+    if (Options::zeroStackFrame())
+        clearStackFrame(callFrameRegister, stackPointerRegister, regT0, maxFrameSize);
+
+    emitSaveCalleeSaves();
+    emitMaterializeTagCheckRegisters();
+
     if (m_codeBlock->codeType() == FunctionCode) {
         ASSERT(m_bytecodeOffset == std::numeric_limits<unsigned>::max());
@@ -701 +717 @@
         }
     }
-
-    int frameTopOffset = stackPointerOffsetFor(m_codeBlock) * sizeof(Register);
-    unsigned maxFrameSize = -frameTopOffset;
-    addPtr(TrustedImm32(frameTopOffset), callFrameRegister, regT1);
-    JumpList stackOverflow;
-    if (UNLIKELY(maxFrameSize > Options::reservedZoneSize()))
-        stackOverflow.append(branchPtr(Above, regT1, callFrameRegister));
-    stackOverflow.append(branchPtr(Above, AbsoluteAddress(m_vm->addressOfSoftStackLimit()), regT1));
-
-    move(regT1, stackPointerRegister);
-    checkStackPointerAlignment();
-    if (Options::zeroStackFrame())
-        clearStackFrame(callFrameRegister, stackPointerRegister, regT0, maxFrameSize);
-
-    emitSaveCalleeSaves();
-    emitMaterializeTagCheckRegisters();
     
     RELEASE_ASSERT(!JITCode::isJIT(m_codeBlock->jitType()));