Changeset 245350 in webkit

Timestamp:

May 15, 2019, 2:44:48 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r244865. rdar://problem/50753937

Baseline JIT should do argument value profiling after checking for stack overflow
​https://bugs.webkit.org/show_bug.cgi?id=197052
<rdar://problem/50009602>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/check-stack-overflow-before-value-profiling-arguments.js: Added.

Source/JavaScriptCore:

Otherwise, we may do value profiling without running a write barrier, which
is against the rules of how we do value profiling.

• jit/JIT.cpp: (JSC::JIT::compileWithoutLinking):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@244865 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/check-stack-overflow-before-value-profiling-arguments.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jit/JIT.cpp (modified) (2 diffs)

branches/safari-607-branch/JSTests/ChangeLog

@@ +1 @@
+2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r244865. rdar://problem/50753937
+
+    Baseline JIT should do argument value profiling after checking for stack overflow
+    https://bugs.webkit.org/show_bug.cgi?id=197052
+    <rdar://problem/50009602>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/check-stack-overflow-before-value-profiling-arguments.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    Otherwise, we may do value profiling without running a write barrier, which
+    is against the rules of how we do value profiling.
+    
+    * jit/JIT.cpp:
+    (JSC::JIT::compileWithoutLinking):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244865 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-01  Saam barati  <sbarati@apple.com>
+
+            Baseline JIT should do argument value profiling after checking for stack overflow
+            https://bugs.webkit.org/show_bug.cgi?id=197052
+            <rdar://problem/50009602>
+
+            Reviewed by Yusuke Suzuki.
+
+            * stress/check-stack-overflow-before-value-profiling-arguments.js: Added.
+
 2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r244865. rdar://problem/50753937
+
+    Baseline JIT should do argument value profiling after checking for stack overflow
+    https://bugs.webkit.org/show_bug.cgi?id=197052
+    <rdar://problem/50009602>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/check-stack-overflow-before-value-profiling-arguments.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    Otherwise, we may do value profiling without running a write barrier, which
+    is against the rules of how we do value profiling.
+    
+    * jit/JIT.cpp:
+    (JSC::JIT::compileWithoutLinking):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244865 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-01  Saam barati  <sbarati@apple.com>
+
+            Baseline JIT should do argument value profiling after checking for stack overflow
+            https://bugs.webkit.org/show_bug.cgi?id=197052
+            <rdar://problem/50009602>
+
+            Reviewed by Yusuke Suzuki.
+
+            Otherwise, we may do value profiling without running a write barrier, which
+            is against the rules of how we do value profiling.
+
+            * jit/JIT.cpp:
+            (JSC::JIT::compileWithoutLinking):
+
 2019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/jit/JIT.cpp

@@ -681 +681 @@
 #endif
 
+    int frameTopOffset = stackPointerOffsetFor(m_codeBlock) * sizeof(Register);
+    unsigned maxFrameSize = -frameTopOffset;
+    addPtr(TrustedImm32(frameTopOffset), callFrameRegister, regT1);
+    JumpList stackOverflow;
+    if (UNLIKELY(maxFrameSize > Options::reservedZoneSize()))
+        stackOverflow.append(branchPtr(Above, regT1, callFrameRegister));
+    stackOverflow.append(branchPtr(Above, AbsoluteAddress(m_vm->addressOfSoftStackLimit()), regT1));
+
+    move(regT1, stackPointerRegister);
+    checkStackPointerAlignment();
+    if (Options::zeroStackFrame())
+        clearStackFrame(callFrameRegister, stackPointerRegister, regT0, maxFrameSize);
+
+    emitSaveCalleeSaves();
+    emitMaterializeTagCheckRegisters();
+
     if (m_codeBlock->codeType() == FunctionCode) {
         ASSERT(m_bytecodeOffset == std::numeric_limits<unsigned>::max());
@@ -700 +716 @@
         }
     }
-
-    int frameTopOffset = stackPointerOffsetFor(m_codeBlock) * sizeof(Register);
-    unsigned maxFrameSize = -frameTopOffset;
-    addPtr(TrustedImm32(frameTopOffset), callFrameRegister, regT1);
-    JumpList stackOverflow;
-    if (UNLIKELY(maxFrameSize > Options::reservedZoneSize()))
-        stackOverflow.append(branchPtr(Above, regT1, callFrameRegister));
-    stackOverflow.append(branchPtr(Above, AbsoluteAddress(m_vm->addressOfSoftStackLimit()), regT1));
-
-    move(regT1, stackPointerRegister);
-    checkStackPointerAlignment();
-    if (Options::zeroStackFrame())
-        clearStackFrame(callFrameRegister, stackPointerRegister, regT0, maxFrameSize);
-
-    emitSaveCalleeSaves();
-    emitMaterializeTagCheckRegisters();
     
     RELEASE_ASSERT(!JITCode::isJIT(m_codeBlock->jitType()));