Changeset 240832 in webkit


Ignore:
Timestamp:
Jan 31, 2019, 5:37:36 PM (6 years ago)
Author:
mark.lam@apple.com
Message:

Remove poisoning from CodeBlock and LLInt code.
​https://bugs.webkit.org/show_bug.cgi?id=194113

Reviewed by Yusuke Suzuki.

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::~CodeBlock):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
(JSC::CodeBlock::jettison):
(JSC::CodeBlock::predictedMachineCodeSize):

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::vm const):
(JSC::CodeBlock::addConstant):
(JSC::CodeBlock::heap const):
(JSC::CodeBlock::replaceConstant):

  • llint/LLIntOfflineAsmConfig.h:
  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::handleHostCall):
(JSC::LLInt::setUpCall):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
Location:
trunk/Source/JavaScriptCore
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r240823 r240832  
     12019-01-31  Mark Lam  <mark.lam@apple.com>
     2
     3        Remove poisoning from CodeBlock and LLInt code.
     4        https://bugs.webkit.org/show_bug.cgi?id=194113
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        * bytecode/CodeBlock.cpp:
     9        (JSC::CodeBlock::CodeBlock):
     10        (JSC::CodeBlock::~CodeBlock):
     11        (JSC::CodeBlock::setConstantRegisters):
     12        (JSC::CodeBlock::propagateTransitions):
     13        (JSC::CodeBlock::finalizeLLIntInlineCaches):
     14        (JSC::CodeBlock::jettison):
     15        (JSC::CodeBlock::predictedMachineCodeSize):
     16        * bytecode/CodeBlock.h:
     17        (JSC::CodeBlock::vm const):
     18        (JSC::CodeBlock::addConstant):
     19        (JSC::CodeBlock::heap const):
     20        (JSC::CodeBlock::replaceConstant):
     21        * llint/LLIntOfflineAsmConfig.h:
     22        * llint/LLIntSlowPaths.cpp:
     23        (JSC::LLInt::handleHostCall):
     24        (JSC::LLInt::setUpCall):
     25        * llint/LowLevelInterpreter.asm:
     26        * llint/LowLevelInterpreter32_64.asm:
     27        * llint/LowLevelInterpreter64.asm:
     28
    1292019-01-31  Yusuke Suzuki  <ysuzuki@apple.com>
    230

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r240329 r240832  
    306306    , m_unlinkedCode(*other.vm(), this, other.m_unlinkedCode.get())
    307307    , m_ownerExecutable(*other.vm(), this, other.m_ownerExecutable.get())
    308     , m_poisonedVM(other.m_poisonedVM)
     308    , m_vm(other.m_vm)
    309309    , m_instructions(other.m_instructions)
    310310    , m_instructionsRawPointer(other.m_instructionsRawPointer)
    … …  
    372372    , m_unlinkedCode(*vm, this, unlinkedCodeBlock)
    373373    , m_ownerExecutable(*vm, this, ownerExecutable)
    374     , m_poisonedVM(vm)
     374    , m_vm(vm)
    375375    , m_instructions(&unlinkedCodeBlock->instructions())
    376376    , m_instructionsRawPointer(m_instructions->rawPointer())
    … …  
    835835CodeBlock::~CodeBlock()
    836836{
    837     VM& vm = *m_poisonedVM;
     837    VM& vm = *m_vm;
    838838
    839839    vm.heap.codeBlockSet().remove(this);
    … …  
    895895void CodeBlock::setConstantRegisters(const Vector<WriteBarrier<Unknown>>& constants, const Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation)
    896896{
    897     VM& vm = *m_poisonedVM;
     897    VM& vm = *m_vm;
    898898    auto scope = DECLARE_THROW_SCOPE(vm);
    899899    JSGlobalObject* globalObject = m_globalObject.get();
    … …  
    10881088    UNUSED_PARAM(visitor);
    10891089
    1090     VM& vm = *m_poisonedVM;
     1090    VM& vm = *m_vm;
    10911091
    10921092    if (jitType() == JITCode::InterpreterThunk) {
    … …  
    12041204void CodeBlock::finalizeLLIntInlineCaches()
    12051205{
    1206     VM& vm = *m_poisonedVM;
     1206    VM& vm = *m_vm;
    12071207    const Vector<InstructionStream::Offset>& propertyAccessInstructions = m_unlinkedCode->propertyAccessInstructions();
    12081208
    … …  
    19221922#endif // ENABLE(DFG_JIT)
    19231923
    1924     VM& vm = *m_poisonedVM;
     1924    VM& vm = *m_vm;
    19251925    DeferGCForAWhile deferGC(*heap());
    19261926   
    … …  
    27632763size_t CodeBlock::predictedMachineCodeSize()
    27642764{
    2765     VM* vm = m_poisonedVM.unpoisoned();
    2766     // This will be called from CodeBlock::CodeBlock before either m_poisonedVM or the
     2765    VM* vm = m_vm;
     2766    // This will be called from CodeBlock::CodeBlock before either m_vm or the
    27672767    // instructions have been initialized. It's OK to return 0 because what will really
    27682768    // matter is the recomputation of this value when the slow path is triggered.

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

    r240255 r240832  
    11/*
    2  * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
    44 *
    … …  
    5252#include "JITCodeMap.h"
    5353#include "JITMathICForwards.h"
    54 #include "JSCPoison.h"
    5554#include "JSCast.h"
    5655#include "JSGlobalObject.h"
    … …  
    380379    ExecutableToCodeBlockEdge* ownerEdge() const { return m_ownerEdge.get(); }
    381380
    382     VM* vm() const { return m_poisonedVM.unpoisoned(); }
     381    VM* vm() const { return m_vm; }
    383382
    384383    void setThisRegister(VirtualRegister thisRegister) { m_thisRegister = thisRegister; }
    … …  
    522521        unsigned result = m_constantRegisters.size();
    523522        m_constantRegisters.append(WriteBarrier<Unknown>());
    524         m_constantRegisters.last().set(*m_poisonedVM, this, v);
     523        m_constantRegisters.last().set(*m_vm, this, v);
    525524        m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
    526525        return result;
    … …  
    548547    const BitVector& bitVector(size_t i) { return m_unlinkedCode->bitVector(i); }
    549548
    550     Heap* heap() const { return &m_poisonedVM->heap; }
     549    Heap* heap() const { return &m_vm->heap; }
    551550    JSGlobalObject* globalObject() { return m_globalObject.get(); }
    552551
    … …  
    898897    {
    899898        ASSERT(isConstantRegisterIndex(index) && static_cast<size_t>(index - FirstConstantRegisterIndex) < m_constantRegisters.size());
    900         m_constantRegisters[index - FirstConstantRegisterIndex].set(*m_poisonedVM, this, value);
     899        m_constantRegisters[index - FirstConstantRegisterIndex].set(*m_vm, this, value);
    901900    }
    902901
    … …  
    946945    WriteBarrier<ExecutableBase> m_ownerExecutable;
    947946    WriteBarrier<ExecutableToCodeBlockEdge> m_ownerEdge;
    948     Poisoned<CodeBlockPoison, VM*> m_poisonedVM;
     947    VM* m_vm;
    949948
    950949    const InstructionStream* m_instructions;
    … …  
    955954    mutable CodeBlockHash m_hash;
    956955
    957     PoisonedRefPtr<CodeBlockPoison, SourceProvider> m_source;
     956    RefPtr<SourceProvider> m_source;
    958957    unsigned m_sourceOffset;
    959958    unsigned m_firstLineColumnOffset;
    … …  
    961960    SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo>> m_incomingLLIntCalls;
    962961    StructureWatchpointMap m_llintGetByIdWatchpointMap;
    963     PoisonedRefPtr<CodeBlockPoison, JITCode> m_jitCode;
     962    RefPtr<JITCode> m_jitCode;
    964963#if !ENABLE(C_LOOP)
    965964    std::unique_ptr<RegisterAtOffsetList> m_calleeSaveRegisters;
    966965#endif
    967966#if ENABLE(JIT)
    968     PoisonedBag<CodeBlockPoison, StructureStubInfo> m_stubInfos;
    969     PoisonedBag<CodeBlockPoison, JITAddIC> m_addICs;
    970     PoisonedBag<CodeBlockPoison, JITMulIC> m_mulICs;
    971     PoisonedBag<CodeBlockPoison, JITNegIC> m_negICs;
    972     PoisonedBag<CodeBlockPoison, JITSubIC> m_subICs;
    973     PoisonedBag<CodeBlockPoison, ByValInfo> m_byValInfos;
    974     PoisonedBag<CodeBlockPoison, CallLinkInfo> m_callLinkInfos;
     967    Bag<StructureStubInfo> m_stubInfos;
     968    Bag<JITAddIC> m_addICs;
     969    Bag<JITMulIC> m_mulICs;
     970    Bag<JITNegIC> m_negICs;
     971    Bag<JITSubIC> m_subICs;
     972    Bag<ByValInfo> m_byValInfos;
     973    Bag<CallLinkInfo> m_callLinkInfos;
    975974    SentinelLinkedList<CallLinkInfo, BasicRawSentinelNode<CallLinkInfo>> m_incomingCalls;
    976975    SentinelLinkedList<PolymorphicCallNode, BasicRawSentinelNode<PolymorphicCallNode>> m_incomingPolymorphicCalls;

  • trunk/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h

    r240684 r240832  
    11/*
    2  * Copyright (C) 2012-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2929#include <wtf/Assertions.h>
    3030#include <wtf/Gigacage.h>
    31 #include <wtf/Poisoned.h>
    3231
    3332#if ENABLE(C_LOOP)
    … …  
    137136#endif
    138137
    139 #if ENABLE(POISON)
    140 #define OFFLINE_ASM_POISON 1
    141 #else
    142 #define OFFLINE_ASM_POISON 0
    143 #endif
    144 
    145138#if !ASSERT_DISABLED
    146139#define OFFLINE_ASM_ASSERT_ENABLED 1

  • trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r240637 r240832  
    14491449            execCallee->setCallee(asObject(callee));
    14501450            vm.hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
    1451            
    1452             PoisonedMasmPtr::assertIsNotPoisoned(LLInt::getCodePtr(getHostCallReturnValue));
    14531451            LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue), CFunctionPtrTag);
    14541452        }
    … …  
    14711469        execCallee->setCallee(asObject(callee));
    14721470        vm.hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
    1473 
    1474         PoisonedMasmPtr::assertIsNotPoisoned(LLInt::getCodePtr(getHostCallReturnValue));
    14751471        LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue), CFunctionPtrTag);
    14761472    }
    … …  
    15091505
    15101506            assertIsTaggedWith(codePtr.executableAddress(), JSEntryPtrTag);
    1511             PoisonedMasmPtr::assertIsNotPoisoned(codePtr.executableAddress());
    15121507            LLINT_CALL_RETURN(exec, execCallee, codePtr.executableAddress(), JSEntryPtrTag);
    15131508        }
    … …  
    15601555
    15611556    assertIsTaggedWith(codePtr.executableAddress(), JSEntryPtrTag);
    1562     PoisonedMasmPtr::assertIsNotPoisoned(codePtr.executableAddress());
    15631557    LLINT_CALL_RETURN(exec, execCallee, codePtr.executableAddress(), JSEntryPtrTag);
    15641558}

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r240432 r240832  
    842842end
    843843
    844 macro unpoison(poison, fieldReg, scratch)
    845     if POISON
    846         loadp poison, scratch
    847         xorp scratch, fieldReg
    848     end
    849 end
    850 
    851844macro functionPrologue()
    852845    tagReturnAddress sp
    … …  
    10281021end
    10291022
    1030 macro functionForCallCodeBlockGetter(targetRegister, scratch)
     1023macro functionForCallCodeBlockGetter(targetRegister)
    10311024    if JSVALUE64
    10321025        loadp Callee[cfr], targetRegister
    … …  
    10351028    end
    10361029    loadp JSFunction::m_executable[targetRegister], targetRegister
    1037     unpoison(_g_JSFunctionPoison, targetRegister, scratch)
    10381030    loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
    10391031    loadp ExecutableToCodeBlockEdge::m_codeBlock[targetRegister], targetRegister
    10401032end
    10411033
    1042 macro functionForConstructCodeBlockGetter(targetRegister, scratch)
     1034macro functionForConstructCodeBlockGetter(targetRegister)
    10431035    if JSVALUE64
    10441036        loadp Callee[cfr], targetRegister
    … …  
    10471039    end
    10481040    loadp JSFunction::m_executable[targetRegister], targetRegister
    1049     unpoison(_g_JSFunctionPoison, targetRegister, scratch)
    10501041    loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
    10511042    loadp ExecutableToCodeBlockEdge::m_codeBlock[targetRegister], targetRegister
    10521043end
    10531044
    1054 macro notFunctionCodeBlockGetter(targetRegister, ignored)
     1045macro notFunctionCodeBlockGetter(targetRegister)
    10551046    loadp CodeBlock[cfr], targetRegister
    10561047end
    … …  
    10761067        addp maxFrameExtentForSlowPathCall, sp
    10771068    end
    1078     codeBlockGetter(t1, t2)
     1069    codeBlockGetter(t1)
    10791070    if not C_LOOP
    10801071        baddis 5, CodeBlock::m_llintExecuteCounter + BaselineExecutionCounter::m_counter[t1], .continue
    … …  
    11061097        jmp r0, JSEntryPtrTag
    11071098    .recover:
    1108         codeBlockGetter(t1, t2)
     1099        codeBlockGetter(t1)
    11091100    .continue:
    11101101    end
    … …  
    11171108    if JSVALUE64
    11181109        loadp CodeBlock::m_instructionsRawPointer[t1], PB
    1119         unpoison(_g_CodeBlockPoison, PB, t3)
    11201110        move 0, PC
    11211111    else
    … …  
    11271117    subp cfr, t0, t0
    11281118    bpa t0, cfr, .needStackCheck
    1129     loadp CodeBlock::m_poisonedVM[t1], t2
    1130     unpoison(_g_CodeBlockPoison, t2, t3)
     1119    loadp CodeBlock::m_vm[t1], t2
    11311120    if C_LOOP
    11321121        bpbeq VM::m_cloopStackLimit[t2], t0, .stackHeightOK
    … …  
    11531142    # Stack check slow path returned that the stack was ok.
    11541143    # Since they were clobbered, need to get CodeBlock and new sp
    1155     codeBlockGetter(t1, t2)
     1144    codeBlockGetter(t1)
    11561145    getFrameRegisterSizeForCodeBlock(t1, t0)
    11571146    subp cfr, t0, t0
    … …  
    16411630llintOp(op_check_traps, OpCheckTraps, macro (unused, unused, dispatch)
    16421631    loadp CodeBlock[cfr], t1
    1643     loadp CodeBlock::m_poisonedVM[t1], t1
    1644     unpoison(_g_CodeBlockPoison, t1, t2)
     1632    loadp CodeBlock::m_vm[t1], t1
    16451633    loadb VM::m_traps+VMTraps::m_needTrapHandling[t1], t0
    16461634    btpnz t0, .handleTraps
    … …  
    16581646macro acquireShadowChickenPacket(slow)
    16591647    loadp CodeBlock[cfr], t1
    1660     loadp CodeBlock::m_poisonedVM[t1], t1
    1661     unpoison(_g_CodeBlockPoison, t1, t2)
     1648    loadp CodeBlock::m_vm[t1], t1
    16621649    loadp VM::m_shadowChicken[t1], t2
    16631650    loadp ShadowChicken::m_logCursor[t2], t0

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r240254 r240832  
    24122412llintOpWithMetadata(op_profile_type, OpProfileType, macro (size, get, dispatch, metadata, return)
    24132413    loadp CodeBlock[cfr], t1
    2414     loadp CodeBlock::m_poisonedVM[t1], t1
    2415     unpoison(_g_CodeBlockPoison, t1, t2)
     2414    loadp CodeBlock::m_vm[t1], t1
    24162415    # t1 is holding the pointer to the typeProfilerLog.
    24172416    loadp VM::m_typeProfilerLog[t1], t1

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r240254 r240832  
    8181    loadp CodeBlock[cfr], PB
    8282    loadp CodeBlock::m_instructionsRawPointer[PB], PB
    83     unpoison(_g_CodeBlockPoison, PB, t1)
    8483    get(size, opcodeStruct, m_dst, t1)
    8584    storeq r0, [cfr, t1, 8]
    … …  
    532531end
    533532
    534 macro structureIDToStructureWithScratch(structureIDThenStructure, scratch, scratch2)
     533macro structureIDToStructureWithScratch(structureIDThenStructure, scratch)
    535534    loadp CodeBlock[cfr], scratch
    536     loadp CodeBlock::m_poisonedVM[scratch], scratch
    537     unpoison(_g_CodeBlockPoison, scratch, scratch2)
     535    loadp CodeBlock::m_vm[scratch], scratch
    538536    loadp VM::heap + Heap::m_structureIDTable + StructureIDTable::m_table[scratch], scratch
    539537    loadp [scratch, structureIDThenStructure, PtrSize], structureIDThenStructure
    540538end
    541539
    542 macro loadStructureWithScratch(cell, structure, scratch, scratch2)
     540macro loadStructureWithScratch(cell, structure, scratch)
    543541    loadi JSCell::m_structureID[cell], structure
    544     structureIDToStructureWithScratch(structure, scratch, scratch2)
     542    structureIDToStructureWithScratch(structure, scratch)
    545543end
    546544
    … …  
    630628    loadp CodeBlock[cfr], t1
    631629    loadp CodeBlock::m_instructionsRawPointer[t1], PB
    632     unpoison(_g_CodeBlockPoison, PB, t2)
    633630    move 0, PC
    634631    jmp doneLabel
    … …  
    698695    btqnz t0, tagMask, .opToThisSlow
    699696    bbneq JSCell::m_type[t0], FinalObjectType, .opToThisSlow
    700     loadStructureWithScratch(t0, t1, t2, t3)
     697    loadStructureWithScratch(t0, t1, t2)
    701698    metadata(t2, t3)
    702699    loadp OpToThis::Metadata::m_cachedStructure[t2], t2
    … …  
    768765        jmp .done
    769766    .masqueradesAsUndefined:
    770         loadStructureWithScratch(t0, t2, t1, t3)
     767        loadStructureWithScratch(t0, t2, t1)
    771768        loadp CodeBlock[cfr], t0
    772769        loadp CodeBlock::m_globalObject[t0], t0
    … …  
    11861183    return(t1)
    11871184.masqueradesAsUndefined:
    1188     loadStructureWithScratch(t0, t3, t1, t5)
     1185    loadStructureWithScratch(t0, t3, t1)
    11891186    loadp CodeBlock[cfr], t1
    11901187    loadp CodeBlock::m_globalObject[t1], t1
    … …  
    13571354    btpz t3, .opPutByIdTransitionDirect
    13581355
    1359     structureIDToStructureWithScratch(t2, t1, t3)
     1356    structureIDToStructureWithScratch(t2, t1)
    13601357
    13611358    # reload the StructureChain since we used t3 as a scratch above
    … …  
    16951692        loadq [cfr, t0, 8], t0
    16961693        btqnz t0, tagMask, .immediate
    1697         loadStructureWithScratch(t0, t2, t1, t3)
     1694        loadStructureWithScratch(t0, t2, t1)
    16981695        cellHandler(t2, JSCell::m_flags[t0], .target)
    16991696        dispatch()
    … …  
    19351932        storei t2, ArgumentCount + PayloadOffset[t3]
    19361933        move t3, sp
    1937         if POISON
    1938             loadp _g_JITCodePoison, t2
    1939             xorp %opcodeStruct%::Metadata::m_callLinkInfo.machineCodeTarget[t5], t2
    1940             prepareCall(t2, t1, t3, t4, JSEntryPtrTag)
    1941             callTargetFunction(size, opcodeStruct, dispatch, t2, JSEntryPtrTag)
    1942         else
    1943             prepareCall(%opcodeStruct%::Metadata::m_callLinkInfo.machineCodeTarget[t5], t2, t3, t4, JSEntryPtrTag)
    1944             callTargetFunction(size, opcodeStruct, dispatch, %opcodeStruct%::Metadata::m_callLinkInfo.machineCodeTarget[t5], JSEntryPtrTag)
    1945         end
     1934        prepareCall(%opcodeStruct%::Metadata::m_callLinkInfo.machineCodeTarget[t5], t2, t3, t4, JSEntryPtrTag)
     1935        callTargetFunction(size, opcodeStruct, dispatch, %opcodeStruct%::Metadata::m_callLinkInfo.machineCodeTarget[t5], JSEntryPtrTag)
    19461936
    19471937    .opCallSlow:
    … …  
    19891979    loadp CodeBlock::m_metadata[PB], metadataTable
    19901980    loadp CodeBlock::m_instructionsRawPointer[PB], PB
    1991     unpoison(_g_CodeBlockPoison, PB, t2)
    19921981    loadp VM::targetInterpreterPCForThrow[t3], PC
    19931982    subp PB, PC
    … …  
    20662055    loadp Callee[cfr], t1
    20672056    loadp JSFunction::m_executable[t1], t1
    2068     unpoison(_g_JSFunctionPoison, t1, t2)
    20692057    checkStackPointerAlignment(t3, 0xdead0001)
    20702058    if C_LOOP
    2071         loadp _g_NativeCodePoison, t2
    2072         xorp executableOffsetToFunction[t1], t2
    2073         cloopCallNative t2
     2059        cloopCallNative executableOffsetToFunction[t1]
    20742060    else
    20752061        if X86_64_WIN
    … …  
    20782064            addp 32, sp
    20792065        else
    2080             loadp _g_NativeCodePoison, t2
    2081             xorp executableOffsetToFunction[t1], t2
    2082             call t2, JSEntryPtrTag
     2066            call executableOffsetToFunction[t1], JSEntryPtrTag
    20832067        end
    20842068    end
    … …  
    21122096    checkStackPointerAlignment(t3, 0xdead0001)
    21132097    if C_LOOP
    2114         loadp _g_NativeCodePoison, t2
    2115         xorp offsetOfFunction[t1], t2
    2116         cloopCallNative t2
     2098        cloopCallNative offsetOfFunction[t1]
    21172099    else
    21182100        if X86_64_WIN
    … …  
    21212103            addp 32, sp
    21222104        else
    2123             loadp _g_NativeCodePoison, t2
    2124             xorp offsetOfFunction[t1], t2
    2125             call t2, JSEntryPtrTag
     2105            call offsetOfFunction[t1], JSEntryPtrTag
    21262106        end
    21272107    end
    … …  
    22352215    get(m_scope, t0)
    22362216    loadq [cfr, t0, 8], t0
    2237     loadStructureWithScratch(t0, t2, t1, t3)
     2217    loadStructureWithScratch(t0, t2, t1)
    22382218    loadp %opcodeStruct%::Metadata::m_structure[t5], t1
    22392219    bpneq t2, t1, slowPath
    … …  
    24722452llintOpWithMetadata(op_profile_type, OpProfileType, macro (size, get, dispatch, metadata, return)
    24732453    loadp CodeBlock[cfr], t1
    2474     loadp CodeBlock::m_poisonedVM[t1], t1
    2475     unpoison(_g_CodeBlockPoison, t1, t3)
     2454    loadp CodeBlock::m_vm[t1], t1
    24762455    # t1 is holding the pointer to the typeProfilerLog.
    24772456    loadp VM::m_typeProfilerLog[t1], t1
Note: See TracChangeset for help on using the changeset viewer.