Changeset 161084 in webkit

Timestamp:

Dec 25, 2013, 11:17:13 PM (11 years ago)

Author:

mark.lam@apple.com

Message:

jsc-layout-tests.yaml/js/script-tests/function-apply-aliased.js.layout-no-cjit is failing.
​https://bugs.webkit.org/show_bug.cgi?id=126174.

Not yet reviewed.

When we do a stack check in a function prologue, the activation object
in the frame hasn't been set yet. The test failures came from the stack
unwinding code trying to tear off the frame to a non-existant activation
object. Since we haven't entered the function yet and the frame is
technically not fully "pushed" yet, we can throw i.e. start the unwinding
from the caller frame instead. This fixes the issue.

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• When we have a StackOverflowError, return the caller's CallFrame in the second value in the SlowPathReturnType.
• llint/LowLevelInterpreter.asm:
• Check if the second value of the SlowPathReturnType from the stack check is 0. If not 0, set the cfr to the returned CallFrame* before we start handling the StackOverflowError and unwinding the stack.

Location:

branches/jsCStack/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• llint/LLIntSlowPaths.cpp (modified) (2 diffs)
• llint/LowLevelInterpreter.asm (modified) (1 diff)

branches/jsCStack/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-12-25  Mark Lam  <mark.lam@apple.com>
+
+        jsc-layout-tests.yaml/js/script-tests/function-apply-aliased.js.layout-no-cjit is failing.
+        https://bugs.webkit.org/show_bug.cgi?id=126174.
+
+        Not yet reviewed.
+
+        When we do a stack check in a function prologue, the activation object
+        in the frame hasn't been set yet. The test failures came from the stack
+        unwinding code trying to tear off the frame to a non-existant activation
+        object. Since we haven't entered the function yet and the frame is
+        technically not fully "pushed" yet, we can throw i.e. start the unwinding
+        from the caller frame instead. This fixes the issue.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        - When we have a StackOverflowError, return the caller's CallFrame in
+          the second value in the SlowPathReturnType.
+        * llint/LowLevelInterpreter.asm:
+        - Check if the second value of the SlowPathReturnType from the stack
+          check is 0. If not 0, set the cfr to the returned CallFrame* before
+          we start handling the StackOverflowError and unwinding the stack.
+
 2013-12-24  Michael Saboff  <msaboff@apple.com>
 

branches/jsCStack/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

@@ -443 +443 @@
 #endif
 
+    // This stack check is done in the prologue for a function call, and the
+    // CallFrame is not completely set up yet. For example, if the frame needs
+    // an activation object, the activation object will only be set up after
+    // we start executing the function. If we need to throw a StackOverflowError
+    // here, then we need to tell the prologue to start the stack unwinding from
+    // the caller frame (which is fully set up) instead. To do that, we return
+    // the caller's CallFrame in the second return value.
+    //
+    // If the stack check succeeds and we don't need to throw the error, then
+    // we'll return 0 instead. The prologue will check for a non-zero value
+    // when determining whether to set the callFrame or not.
+
     // For JIT enabled builds which uses the C stack, the stack is not growable.
     // Hence, if we get here, then we know a stack overflow is imminent. So, just
@@ -448 +460 @@
 #if ENABLE(LLINT_C_LOOP)
     ASSERT(!exec->vm().interpreter->stack().containsAddress(exec->topOfFrame()));
-    if (UNLIKELY(!vm.interpreter->stack().ensureCapacityFor(exec->topOfFrame())))
+    if (LIKELY(vm.interpreter->stack().ensureCapacityFor(exec->topOfFrame())))
+        LLINT_RETURN_TWO(pc, 0);
 #endif
-    {
-        exec = exec->callerFrame();
-        Interpreter::ErrorHandlingMode mode(exec);
-        CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));
-        pc = returnToThrowForThrownException(exec);
-    }
-    LLINT_END_IMPL();
+
+    exec = exec->callerFrame();
+    Interpreter::ErrorHandlingMode mode(exec);
+    CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));
+    pc = returnToThrowForThrownException(exec);
+    LLINT_RETURN_TWO(pc, exec);
 }
 

branches/jsCStack/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

@@ -434 +434 @@
     # Stack height check failed - need to call a slow_path.
     callSlowPath(_llint_stack_check)
+    bpeq t1, 0, .stackHeightOK
+    move t1, cfr
 .stackHeightOK:
 end