Changeset 271226 in webkit

Timestamp:

Jan 6, 2021, 11:52:55 PM (6 years ago)

Author:

mark.lam@apple.com

Message:

Fix a dataMemoryTempRegister use violation in FTLLowerDFGToB3's compileLoopHint().
​https://bugs.webkit.org/show_bug.cgi?id=220399

Reviewed by Yusuke Suzuki.

This was tripping an assertion failure on the invalid use of the dataMemoryTempRegister
during a Debug build JSC stress test run with DoesGC validation enabled.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileLoopHint):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-01-06  Mark Lam  <mark.lam@apple.com>
+
+        Fix a dataMemoryTempRegister use violation in FTLLowerDFGToB3's compileLoopHint().
+        https://bugs.webkit.org/show_bug.cgi?id=220399
+
+        Reviewed by Yusuke Suzuki.
+
+        This was tripping an assertion failure on the invalid use of the dataMemoryTempRegister
+        during a Debug build JSC stress test run with DoesGC validation enabled.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileLoopHint):
+
 2021-01-06  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -15071 +15071 @@
                     // We need to mock what a Return does: claims to GC.
                     jit.move(CCallHelpers::TrustedImmPtr(vm->heap.addressOfDoesGC()), GPRInfo::regT0);
-                    jit.store32(CCallHelpers::TrustedImm32(DoesGCCheck::encode(true, DoesGCCheck::Special::Uninitialized)), CCallHelpers::Address(GPRInfo::regT0));
+                    jit.move(CCallHelpers::TrustedImm32(DoesGCCheck::encode(true, DoesGCCheck::Special::Uninitialized)), GPRInfo::regT1);
+                    jit.store32(GPRInfo::regT1, CCallHelpers::Address(GPRInfo::regT0));
                 }
             }