Changeset 191175 in webkit


Ignore:
Timestamp:
Oct 16, 2015 7:43:02 AM (9 years ago)
Author:
msaboff@apple.com
Message:

REGRESSION (r190289): Repro crash clicking back button on netflix.com
​https://bugs.webkit.org/show_bug.cgi?id=150220

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Since constructors check for a valid new "this" object and return it, we can't make
a tail call to another function from within a constructor.

Re-enabled the tail calls and the related tail call tests.

Did some other miscellaneous clean up in the tail call code as part of the debugging.

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::callPreflight):

  • interpreter/Interpreter.h:

(JSC::calleeFrameForVarargs):

  • runtime/Options.h:
  • tests/es6.yaml:
  • tests/stress/dfg-tail-calls.js:

(nonInlinedTailCall.callee):

  • tests/stress/mutual-tail-call-no-stack-overflow.js:

(shouldThrow):

  • tests/stress/tail-call-in-inline-cache.js:

(tail):

  • tests/stress/tail-call-no-stack-overflow.js:

(shouldThrow):

  • tests/stress/tail-call-recognize.js:

(callerMustBeRun):

  • tests/stress/tail-call-varargs-no-stack-overflow.js:

(shouldThrow):

LayoutTests:

Added a new regression test. Changed the expected output of caller-property
to correspond with tail calls enabled.

  • js/caller-property-expected.txt:
  • js/regress-150220-expected.tx: Added.
  • js/regress-150220.html: Added.
  • js/script-tests/regress-150220.js: Added.

(Obj):
(SubObj):

Location:
trunk
Files:
2 added
14 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r191173 r191175  
     12015-10-15  Michael Saboff  <msaboff@apple.com>
     2
     3        REGRESSION (r190289): Repro crash clicking back button on netflix.com
     4        https://bugs.webkit.org/show_bug.cgi?id=150220
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        Added a new regression test.  Changed the expected output of caller-property
     9        to correspond with tail calls enabled.
     10
     11        * js/caller-property-expected.txt:
     12        * js/regress-150220-expected.tx: Added.
     13        * js/regress-150220.html: Added.
     14        * js/script-tests/regress-150220.js: Added.
     15        (Obj):
     16        (SubObj):
     17
    1182015-10-16  Hunseop Jeong  <hs85.jeong@samsung.com>
    219

  • trunk/LayoutTests/js/caller-property-expected.txt

    r190695 r191175  
    1111PASS strictCaller(nonStrictCallee) threw exception TypeError: Function.caller used to retrieve strict caller.
    1212PASS strictCaller(strictCallee) threw exception TypeError: Type error.
    13 FAIL strictTailCaller(nonStrictCallee) should be null. Threw exception TypeError: Function.caller used to retrieve strict caller
     13PASS strictTailCaller(nonStrictCallee) is null
    1414PASS strictTailCaller(strictCallee) threw exception TypeError: Type error.
    1515PASS nonStrictCaller(boundNonStrictCallee) is nonStrictCaller
    … …  
    1717PASS strictCaller(boundNonStrictCallee) threw exception TypeError: Function.caller used to retrieve strict caller.
    1818PASS strictCaller(boundStrictCallee) threw exception TypeError: Type error.
    19 FAIL strictTailCaller(boundNonStrictCallee) should be null. Threw exception TypeError: Function.caller used to retrieve strict caller
     19PASS strictTailCaller(boundNonStrictCallee) is null
    2020PASS strictTailCaller(boundStrictCallee) threw exception TypeError: Type error.
    2121PASS nonStrictGetter(nonStrictAccessor) is nonStrictGetter

  • trunk/Source/JavaScriptCore/ChangeLog

    r191165 r191175  
     12015-10-15  Michael Saboff  <msaboff@apple.com>
     2
     3        REGRESSION (r190289): Repro crash clicking back button on netflix.com
     4        https://bugs.webkit.org/show_bug.cgi?id=150220
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        Since constructors check for a valid new "this" object and return it, we can't make
     9        a tail call to another function from within a constructor.
     10
     11        Re-enabled the tail calls and the related tail call tests.
     12
     13        Did some other miscellaneous clean up in the tail call code as part of the debugging.
     14
     15        * bytecompiler/BytecodeGenerator.cpp:
     16        (JSC::BytecodeGenerator::BytecodeGenerator):
     17        * ftl/FTLLowerDFGToLLVM.cpp:
     18        (JSC::FTL::DFG::LowerDFGToLLVM::callPreflight):
     19        * interpreter/Interpreter.h:
     20        (JSC::calleeFrameForVarargs):
     21        * runtime/Options.h:
     22        * tests/es6.yaml:
     23        * tests/stress/dfg-tail-calls.js:
     24        (nonInlinedTailCall.callee):
     25        * tests/stress/mutual-tail-call-no-stack-overflow.js:
     26        (shouldThrow):
     27        * tests/stress/tail-call-in-inline-cache.js:
     28        (tail):
     29        * tests/stress/tail-call-no-stack-overflow.js:
     30        (shouldThrow):
     31        * tests/stress/tail-call-recognize.js:
     32        (callerMustBeRun):
     33        * tests/stress/tail-call-varargs-no-stack-overflow.js:
     34        (shouldThrow):
     35
    1362015-10-15  Joseph Pecoraro  <pecoraro@apple.com>
    237

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r191058 r191175  
    199199    // compatible with tail calls (we have no way of emitting op_did_call).
    200200    // https://bugs.webkit.org/show_bug.cgi?id=148819
    201     , m_inTailPosition(Options::useTailCalls() && constructorKind() == ConstructorKind::None && isStrictMode() && !m_shouldEmitProfileHooks)
     201    , m_inTailPosition(Options::useTailCalls() && !isConstructor() && constructorKind() == ConstructorKind::None && isStrictMode() && !m_shouldEmitProfileHooks)
    202202{
    203203    for (auto& constantRegister : m_linkTimeConstantRegisters)

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

    r191058 r191175  
    86178617            || m_node->op() == TailCallVarargsInlinedCaller
    86188618            || m_node->op() == TailCallForwardVarargsInlinedCaller)
    8619             codeOrigin =*codeOrigin.inlineCallFrame->getCallerSkippingDeadFrames();
     8619            codeOrigin = *codeOrigin.inlineCallFrame->getCallerSkippingDeadFrames();
    86208620
    86218621        callPreflight(codeOrigin);

  • trunk/Source/JavaScriptCore/interpreter/Interpreter.h

    r189920 r191175  
    279279    inline CallFrame* calleeFrameForVarargs(CallFrame* callFrame, unsigned numUsedStackSlots, unsigned argumentCountIncludingThis)
    280280    {
    281 #if 1
    282281        // We want the new frame to be allocated on a stack aligned offset with a stack
    283282        // aligned size. Align the size here.
    … …  
    287286
    288287        // Align the frame offset here.
    289 #endif
    290288        unsigned paddedCalleeFrameOffset = WTF::roundUpToMultipleOf(
    291289            stackAlignmentRegisters(),

  • trunk/Source/JavaScriptCore/runtime/Options.h

    r191058 r191175  
    132132    \
    133133    v(bool, useFunctionDotArguments, true, nullptr) \
    134     v(bool, useTailCalls, false, nullptr) \
     134    v(bool, useTailCalls, true, nullptr) \
    135135    \
    136136    /* dumpDisassembly implies dumpDFGDisassembly. */ \

  • trunk/Source/JavaScriptCore/tests/es6.yaml

    r191110 r191175  
    878878  cmd: runES6 :fail
    879879- path: es6/proper_tail_calls_tail_call_optimisation_direct_recursion.js
    880   cmd: runES6 :fail
     880  cmd: runES6 :normal
    881881- path: es6/proper_tail_calls_tail_call_optimisation_mutual_recursion.js
    882   cmd: runES6 :fail
     882  cmd: runES6 :normal
    883883- path: es6/prototype_of_bound_functions_arrow_functions.js
    884884  cmd: runES6 :fail

  • trunk/Source/JavaScriptCore/tests/stress/dfg-tail-calls.js

    r190699 r191175  
    1 //@ skip
    21(function nonInlinedTailCall() {
    32    function callee() { if (callee.caller != nonInlinedTailCall) throw new Error(); }

  • trunk/Source/JavaScriptCore/tests/stress/mutual-tail-call-no-stack-overflow.js

    r190699 r191175  
    1 //@ skip
    21function shouldThrow(func, errorMessage) {
    32    var errorThrown = false;

  • trunk/Source/JavaScriptCore/tests/stress/tail-call-in-inline-cache.js

    r190699 r191175  
    1 //@ skip
    21"use strict";
    32

  • trunk/Source/JavaScriptCore/tests/stress/tail-call-no-stack-overflow.js

    r190699 r191175  
    1 //@ skip
    21function shouldThrow(func, errorMessage) {
    32    var errorThrown = false;

  • trunk/Source/JavaScriptCore/tests/stress/tail-call-recognize.js

    r190699 r191175  
    1 //@ skip
    21function callerMustBeRun() {
    32    if (!Object.is(callerMustBeRun.caller, runTests))

  • trunk/Source/JavaScriptCore/tests/stress/tail-call-varargs-no-stack-overflow.js

    r190699 r191175  
    1 //@ skip
    21function shouldThrow(func, errorMessage) {
    32    var errorThrown = false;
Note: See TracChangeset for help on using the changeset viewer.