Changeset 191625 in webkit

Timestamp:

Oct 27, 2015, 10:48:51 AM (10 years ago)

Author:

msaboff@apple.com

Message:

REGRESSION (r191360): Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::FTL:: + 386
​https://bugs.webkit.org/show_bug.cgi?id=150580

Reviewed by Mark Lam.

Source/JavaScriptCore:

Changed code to box 32 bit integers and booleans arguments when generating the call instead of boxing
them in the shuffler.

The ASSERT in CallFrameShuffler::extendFrameIfNeeded is wrong when called from CallFrameShuffler::spill(),
as we could be making space to spill a register so that we have a spare that we can use for the new
frame's base pointer.

• ftl/FTLJSTailCall.cpp:

(JSC::FTL::DFG::recoveryFor): Added RELEASE_ASSERT to check that we never see unboxed 32 bit
arguments stored in the stack.

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::exitValueForTailCall):

• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::extendFrameIfNeeded): Removed unneeded ASSERT.

LayoutTests:

New regression test.

• js/regress-150580-expected.txt: Added.
• js/regress-150580.html: Added.
• js/script-tests/regress-150580.js: Added.

(addEmUp):
(sumVector):
(test):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/regress-150580-expected.txt (added)
• LayoutTests/js/regress-150580.html (added)
• LayoutTests/js/script-tests/regress-150580.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLJSTailCall.cpp (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (modified) (1 diff)
• Source/JavaScriptCore/jit/CallFrameShuffler.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-10-27  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r191360): Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::FTL:: + 386
+        https://bugs.webkit.org/show_bug.cgi?id=150580
+
+        Reviewed by Mark Lam.
+
+        New regression test.
+
+        * js/regress-150580-expected.txt: Added.
+        * js/regress-150580.html: Added.
+        * js/script-tests/regress-150580.js: Added.
+        (addEmUp):
+        (sumVector):
+        (test):
+
 2015-10-20  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-10-27  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r191360): Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::FTL:: + 386
+        https://bugs.webkit.org/show_bug.cgi?id=150580
+
+        Reviewed by Mark Lam.
+
+        Changed code to box 32 bit integers and booleans arguments when generating the call instead of boxing
+        them in the shuffler.
+
+        The ASSERT in CallFrameShuffler::extendFrameIfNeeded is wrong when called from CallFrameShuffler::spill(),
+        as we could be making space to spill a register so that we have a spare that we can use for the new
+        frame's base pointer.
+
+        * ftl/FTLJSTailCall.cpp:
+        (JSC::FTL::DFG::recoveryFor): Added RELEASE_ASSERT to check that we never see unboxed 32 bit
+        arguments stored in the stack.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForTailCall):
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::extendFrameIfNeeded): Removed unneeded ASSERT.
+
 2015-10-26  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/ftl/FTLJSTailCall.cpp

@@ -78 +78 @@
             RELEASE_ASSERT(location.dwarfReg().reg() == Reg(MacroAssembler::framePointerRegister));
             RELEASE_ASSERT(!(location.offset() % sizeof(void*)));
+            // DataFormatInt32 and DataFormatBoolean should be already be boxed.
+            RELEASE_ASSERT(format != DataFormatInt32 && format != DataFormatBoolean);
             return ValueRecovery::displacedInJSStack(VirtualRegister { static_cast<int>(location.offset() / sizeof(void*)) }, format);
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

@@ -9008 +9008 @@
         value = m_int32Values.get(node);
         if (isValid(value))
-            return exitArgument(arguments, DataFormatInt32, value.value());
+            return exitArgument(arguments, DataFormatJS, boxInt32(value.value()));
 
         value = m_booleanValues.get(node);
-        if (isValid(value)) {
-            LValue valueToPass = m_out.zeroExt(value.value(), m_out.int32);
-            return exitArgument(arguments, DataFormatBoolean, valueToPass);
-        }
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatJS, boxBoolean(value.value()));
 
         // Doubles and Int52 have been converted by ValueRep()

trunk/Source/JavaScriptCore/jit/CallFrameShuffler.cpp

@@ -307 +307 @@
 {
     ASSERT(!m_didExtendFrame);
-    ASSERT(!isUndecided());
 
     VirtualRegister firstRead { firstOld() };