Changeset 90502 in webkit


Ignore:
Timestamp:
Jul 6, 2011 2:40:11 PM (13 years ago)
Author:
commit-queue@webkit.org
Message:

2011-07-06 Filip Pizlo <​fpizlo@apple.com>

DFG JIT op_call implementation will flush registers even when those registers are dead
​https://bugs.webkit.org/show_bug.cgi?id=64023

Reviewed by Gavin Barraclough.

  • dfg/DFGJITCodeGenerator.cpp: (JSC::DFG::JITCodeGenerator::emitCall):
  • dfg/DFGJITCodeGenerator.h: (JSC::DFG::JITCodeGenerator::integerResult): (JSC::DFG::JITCodeGenerator::noResult): (JSC::DFG::JITCodeGenerator::cellResult): (JSC::DFG::JITCodeGenerator::jsValueResult): (JSC::DFG::JITCodeGenerator::doubleResult):
  • dfg/DFGNonSpeculativeJIT.cpp: (JSC::DFG::NonSpeculativeJIT::compile):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compile):
Location:
trunk/Source/JavaScriptCore
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r90487 r90502  
     12011-07-06  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG JIT op_call implementation will flush registers even when those registers are dead
     4        https://bugs.webkit.org/show_bug.cgi?id=64023
     5
     6        Reviewed by Gavin Barraclough.
     7
     8        * dfg/DFGJITCodeGenerator.cpp:
     9        (JSC::DFG::JITCodeGenerator::emitCall):
     10        * dfg/DFGJITCodeGenerator.h:
     11        (JSC::DFG::JITCodeGenerator::integerResult):
     12        (JSC::DFG::JITCodeGenerator::noResult):
     13        (JSC::DFG::JITCodeGenerator::cellResult):
     14        (JSC::DFG::JITCodeGenerator::jsValueResult):
     15        (JSC::DFG::JITCodeGenerator::doubleResult):
     16        * dfg/DFGNonSpeculativeJIT.cpp:
     17        (JSC::DFG::NonSpeculativeJIT::compile):
     18        * dfg/DFGSpeculativeJIT.cpp:
     19        (JSC::DFG::SpeculativeJIT::compile):
     20
    1212011-07-06  Filip Pizlo  <fpizlo@apple.com>
    222

  • trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp

    r90423 r90502  
    431431}
    432432
    433 void JITCodeGenerator::emitCall(Node& node, GPRReg targetGPR)
    434 {
     433void JITCodeGenerator::emitCall(Node& node)
     434{
     435    NodeIndex calleeNodeIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
     436    JSValueOperand callee(this, calleeNodeIndex);
     437    GPRReg calleeGPR = callee.gpr();
     438    use(calleeNodeIndex);
     439   
    435440    // the call instruction's first child is either the function (normal call) or the
    436441    // receiver (method call). subsequent children are the arguments.
    … …  
    451456   
    452457    for (int argIdx = 0; argIdx < numArgs; argIdx++) {
    453         JSValueOperand arg(this, m_jit.graph().m_varArgChildren[node.firstChild() + 1 + argIdx]);
     458        NodeIndex argNodeIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1 + argIdx];
     459        JSValueOperand arg(this, argNodeIndex);
    454460        GPRReg argGPR = arg.gpr();
     461        use(argNodeIndex);
    455462       
    456463        m_jit.storePtr(argGPR, addressOfCallData(-callDataSize + argIdx));
    … …  
    459466    switch (node.op) {
    460467    case Call:
    461         m_jit.storePtr(targetGPR, addressOfCallData(RegisterFile::Callee));
     468        m_jit.storePtr(calleeGPR, addressOfCallData(RegisterFile::Callee));
    462469        break;
    463470       
    … …  
    476483    switch (node.op) {
    477484    case Call:
    478         slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, targetGPR, targetToCheck, MacroAssembler::TrustedImmPtr(JSValue::encode(JSValue())));
    479         m_jit.loadPtr(MacroAssembler::Address(targetGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultGPR);
     485        slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleeGPR, targetToCheck, MacroAssembler::TrustedImmPtr(JSValue::encode(JSValue())));
     486        m_jit.loadPtr(MacroAssembler::Address(calleeGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultGPR);
    480487        m_jit.storePtr(resultGPR, addressOfCallData(RegisterFile::ScopeChain));
    481488        break;
    … …  
    504511    m_jit.move(GPRInfo::returnValueGPR, resultGPR);
    505512   
    506     jsValueResult(resultGPR, m_compileIndex);
     513    jsValueResult(resultGPR, m_compileIndex, DataFormatJS, UseChildrenCalledExplicitly);
    507514   
    508515    m_jit.addJSCall(fastCall, slowCall, targetToCheck, true, m_jit.graph()[m_compileIndex].exceptionInfo);

  • trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h

    r90423 r90502  
    6565        SpillOrderDouble = 6,   // needs spill and convert
    6666    };
     67   
     68    enum UseChildrenMode { CallUseChildren, UseChildrenCalledExplicitly };
    6769
    6870
    … …  
    529531    }
    530532   
    531     void emitCall(Node&, GPRReg targetGPR);
     533    void emitCall(Node&);
    532534
    533535    // Called once a node has completed code generation but prior to setting
    … …  
    539541    // These method called to initialize the the GenerationInfo
    540542    // to describe the result of an operation.
    541     void integerResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatInteger)
     543    void integerResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatInteger, UseChildrenMode mode = CallUseChildren)
    542544    {
    543545        Node& node = m_jit.graph()[nodeIndex];
    544         useChildren(node);
     546        if (mode == CallUseChildren)
     547            useChildren(node);
    545548
    546549        VirtualRegister virtualRegister = node.virtualRegister();
    … …  
    558561        }
    559562    }
    560     void noResult(NodeIndex nodeIndex)
    561     {
     563    void noResult(NodeIndex nodeIndex, UseChildrenMode mode = CallUseChildren)
     564    {
     565        if (mode == UseChildrenCalledExplicitly)
     566            return;
    562567        Node& node = m_jit.graph()[nodeIndex];
    563568        useChildren(node);
    564569    }
    565     void cellResult(GPRReg reg, NodeIndex nodeIndex)
     570    void cellResult(GPRReg reg, NodeIndex nodeIndex, UseChildrenMode mode = CallUseChildren)
    566571    {
    567572        Node& node = m_jit.graph()[nodeIndex];
    568         useChildren(node);
     573        if (mode == CallUseChildren)
     574            useChildren(node);
    569575
    570576        VirtualRegister virtualRegister = node.virtualRegister();
    … …  
    573579        info.initCell(nodeIndex, node.refCount(), reg);
    574580    }
    575     void jsValueResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatJS)
     581    void jsValueResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatJS, UseChildrenMode mode = CallUseChildren)
    576582    {
    577583        if (format == DataFormatJSInteger)
    … …  
    579585       
    580586        Node& node = m_jit.graph()[nodeIndex];
    581         useChildren(node);
     587        if (mode == CallUseChildren)
     588            useChildren(node);
    582589
    583590        VirtualRegister virtualRegister = node.virtualRegister();
    … …  
    586593        info.initJSValue(nodeIndex, node.refCount(), reg, format);
    587594    }
    588     void doubleResult(FPRReg reg, NodeIndex nodeIndex)
     595    void doubleResult(FPRReg reg, NodeIndex nodeIndex, UseChildrenMode mode = CallUseChildren)
    589596    {
    590597        Node& node = m_jit.graph()[nodeIndex];
    591         useChildren(node);
     598        if (mode == CallUseChildren)
     599            useChildren(node);
    592600
    593601        VirtualRegister virtualRegister = node.virtualRegister();

  • trunk/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp

    r90423 r90502  
    10551055       
    10561056    case Call:
    1057         JSValueOperand callee(this, m_jit.graph().m_varArgChildren[node.firstChild()]);
    1058         GPRReg calleeGPR = callee.gpr();
    1059         emitCall(node, calleeGPR);
     1057        emitCall(node);
    10601058        break;
    10611059    }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r90487 r90502  
    11341134       
    11351135    case Call:
    1136         JSValueOperand callee(this, m_jit.graph().m_varArgChildren[node.firstChild()]);
    1137         GPRReg calleeGPR = callee.gpr();
    1138         emitCall(node, calleeGPR);
     1136        emitCall(node);
    11391137        break;
    11401138    }
Note: See TracChangeset for help on using the changeset viewer.