Changeset 209846 in webkit


Ignore:
Timestamp:
Dec 14, 2016 5:25:16 PM (7 years ago)
Author:
fpizlo@apple.com
Message:

DirectTailCall implementation needs to tell the shuffler what to put into the ArgumentCount explicitly
​https://bugs.webkit.org/show_bug.cgi?id=165882

Reviewed by Mark Lam.
JSTests:

  • stress/direct-tail-call-arity-mismatch-count-args.js: Added.

(foo):
(bar):

Source/JavaScriptCore:


The CallFrameShuffler was assuming that the ArgumentCount that it should store into the
callee frame is simply the size of the args vector.

That's not true for DirectTailCall, which will pad the args vector with undefined if we
are optimizing an arity mismatch. We need to pass the ArgumentCount explicitly in this
case.

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
(JSC::FTL::DFG::LowerDFGToB3::compileTailCall):

  • jit/CallFrameShuffleData.h:
  • jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::prepareAny):

  • jit/CallFrameShuffler.h:

(JSC::CallFrameShuffler::snapshot):

  • jit/JITCall.cpp:

(JSC::JIT::compileOpCall):

Location:
trunk
Files:
1 added
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r209830 r209846  
     12016-12-14  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DirectTailCall implementation needs to tell the shuffler what to put into the ArgumentCount explicitly
     4        https://bugs.webkit.org/show_bug.cgi?id=165882
     5
     6        Reviewed by Mark Lam.
     7
     8        * stress/direct-tail-call-arity-mismatch-count-args.js: Added.
     9        (foo):
     10        (bar):
     11
    1122016-12-14  Keith Miller  <keith_miller@apple.com>
    213

  • trunk/Source/JavaScriptCore/ChangeLog

    r209830 r209846  
     12016-12-14  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DirectTailCall implementation needs to tell the shuffler what to put into the ArgumentCount explicitly
     4        https://bugs.webkit.org/show_bug.cgi?id=165882
     5
     6        Reviewed by Mark Lam.
     7       
     8        The CallFrameShuffler was assuming that the ArgumentCount that it should store into the
     9        callee frame is simply the size of the args vector.
     10       
     11        That's not true for DirectTailCall, which will pad the args vector with undefined if we
     12        are optimizing an arity mismatch. We need to pass the ArgumentCount explicitly in this
     13        case.
     14
     15        * dfg/DFGSpeculativeJIT32_64.cpp:
     16        (JSC::DFG::SpeculativeJIT::emitCall):
     17        * dfg/DFGSpeculativeJIT64.cpp:
     18        (JSC::DFG::SpeculativeJIT::emitCall):
     19        * ftl/FTLLowerDFGToB3.cpp:
     20        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
     21        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
     22        * jit/CallFrameShuffleData.h:
     23        * jit/CallFrameShuffler.cpp:
     24        (JSC::CallFrameShuffler::CallFrameShuffler):
     25        (JSC::CallFrameShuffler::prepareAny):
     26        * jit/CallFrameShuffler.h:
     27        (JSC::CallFrameShuffler::snapshot):
     28        * jit/JITCall.cpp:
     29        (JSC::JIT::compileOpCall):
     30
    1312016-12-14  Keith Miller  <keith_miller@apple.com>
    232

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r209764 r209846  
    880880            shuffleData.callee = ValueRecovery::inPair(calleeTagGPR, calleePayloadGPR);
    881881            shuffleData.args.resize(numAllocatedArgs);
     882            shuffleData.numPassedArgs = numPassedArgs;
    882883
    883884            for (unsigned i = 0; i < numPassedArgs; ++i) {

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r209764 r209846  
    852852            shuffleData.callee = ValueRecovery::inGPR(calleeGPR, DataFormatJS);
    853853            shuffleData.args.resize(numAllocatedArgs);
    854 
     854            shuffleData.numPassedArgs = numPassedArgs;
     855           
    855856            for (unsigned i = 0; i < numPassedArgs; ++i) {
    856857                Edge argEdge = m_jit.graph().varArgChild(node, i + 1);

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r209764 r209846  
    59935993                    for (unsigned i = numPassedArgs; i < numAllocatedArgs; ++i)
    59945994                        shuffleData.args.append(ValueRecovery::constant(jsUndefined()));
     5995                    shuffleData.numPassedArgs = numPassedArgs;
    59955996                    shuffleData.setupCalleeSaveRegisters(jit.codeBlock());
    59965997                   
    … …  
    61596160                    shuffleData.args.append(params[1 + i].recoveryForJSValue());
    61606161
     6162                shuffleData.numPassedArgs = numArgs;
     6163               
    61616164                shuffleData.setupCalleeSaveRegisters(jit.codeBlock());
    61626165

  • trunk/Source/JavaScriptCore/jit/CallFrameShuffleData.h

    r209764 r209846  
    11/*
    2  * Copyright (C) 2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3636    WTF_MAKE_FAST_ALLOCATED;
    3737public:
    38     unsigned numLocals;
     38    unsigned numLocals { UINT_MAX };
    3939    ValueRecovery callee;
    4040    Vector<ValueRecovery> args;
     41    unsigned numPassedArgs { UINT_MAX };
    4142#if USE(JSVALUE64)
    4243    RegisterMap<ValueRecovery> registers;

  • trunk/Source/JavaScriptCore/jit/CallFrameShuffler.cpp

    r209764 r209846  
    11/*
    2  * Copyright (C) 2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4545    , m_frameDelta(m_alignedNewFrameSize - m_alignedOldFrameSize)
    4646    , m_lockedRegisters(RegisterSet::allRegisters())
     47    , m_numPassedArgs(data.numPassedArgs)
    4748{
    4849    // We are allowed all the usual registers...
    … …  
    747748    m_jit.store32(MacroAssembler::TrustedImm32(0),
    748749        addressForNew(VirtualRegister { CallFrameSlot::argumentCount }).withOffset(TagOffset));
    749     m_jit.store32(MacroAssembler::TrustedImm32(argCount()),
     750    RELEASE_ASSERT(m_numPassedArgs != UINT_MAX);
     751    m_jit.store32(MacroAssembler::TrustedImm32(m_numPassedArgs),
    750752        addressForNew(VirtualRegister { CallFrameSlot::argumentCount }).withOffset(PayloadOffset));
    751753

  • trunk/Source/JavaScriptCore/jit/CallFrameShuffler.h

    r209764 r209846  
    103103        CallFrameShuffleData data;
    104104        data.numLocals = numLocals();
     105        data.numPassedArgs = m_numPassedArgs;
    105106        data.callee = getNew(VirtualRegister { CallFrameSlot::callee })->recovery();
    106107        data.args.resize(argCount());
    … …  
    795796    // due to high register pressure.
    796797    bool performSafeWrites();
     798   
     799    unsigned m_numPassedArgs { UINT_MAX };
    797800};
    798801

  • trunk/Source/JavaScriptCore/jit/JITCall.cpp

    r209764 r209846  
    199199    if (opcodeID == op_tail_call) {
    200200        CallFrameShuffleData shuffleData;
     201        shuffleData.numPassedArgs = instruction[3].u.operand;
    201202        shuffleData.tagTypeNumber = GPRInfo::tagTypeNumberRegister;
    202203        shuffleData.numLocals =
Note: See TracChangeset for help on using the changeset viewer.