<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[188889] branches/jsc-tailcall/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/188889">188889</a></dd>
<dt>Author</dt> <dd>msaboff@apple.com</dd>
<dt>Date</dt> <dd>2015-08-24 15:40:45 -0700 (Mon, 24 Aug 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>jsc-tailcall: Specialized thunks need to save / restore callee save "tag" registers
https://bugs.webkit.org/show_bug.cgi?id=148345
Reviewed by Basile Clement.
Since these thunks can be called by FTL compiled functions, we can't count on the
tagTypeNumberRegister and tagMaskRegister. In fact, the same registers could be used
for other purposes. Since they are callee saves, save the current values on entry to
these thunks and materialize the tag constant values. On function exit we restore
the caller's values.
* jit/SpecializedThunkJIT.h:
(JSC::SpecializedThunkJIT::SpecializedThunkJIT):
(JSC::SpecializedThunkJIT::loadDoubleArgument):
(JSC::SpecializedThunkJIT::returnJSValue):
(JSC::SpecializedThunkJIT::returnDouble):
(JSC::SpecializedThunkJIT::returnInt32):
(JSC::SpecializedThunkJIT::returnJSCell):
(JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
(JSC::SpecializedThunkJIT::emitSaveThenMaterializeTagRegisters):
(JSC::SpecializedThunkJIT::emitRestoreSavedTagRegisters):
(JSC::SpecializedThunkJIT::tagReturnAsInt32):
* jit/ThunkGenerators.cpp:
(JSC::nativeForGenerator): Since the nativeForGenerator can be called via a tail call
by various specialized thunks, we need to restore the values of the tag constant callee
save registers. The specialized thunks is the only code that make such tail calls
to nativeForGenerator generated code.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branchesjsctailcallSourceJavaScriptCoreChangeLog">branches/jsc-tailcall/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchesjsctailcallSourceJavaScriptCorejitSpecializedThunkJITh">branches/jsc-tailcall/Source/JavaScriptCore/jit/SpecializedThunkJIT.h</a></li>
<li><a href="#branchesjsctailcallSourceJavaScriptCorejitThunkGeneratorscpp">branches/jsc-tailcall/Source/JavaScriptCore/jit/ThunkGenerators.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchesjsctailcallSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/jsc-tailcall/Source/JavaScriptCore/ChangeLog (188888 => 188889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsc-tailcall/Source/JavaScriptCore/ChangeLog 2015-08-24 21:56:38 UTC (rev 188888)
+++ branches/jsc-tailcall/Source/JavaScriptCore/ChangeLog 2015-08-24 22:40:45 UTC (rev 188889)
</span><span class="lines">@@ -1,3 +1,33 @@
</span><ins>+2015-08-24 Michael Saboff <msaboff@apple.com>
+
+ jsc-tailcall: Specialized thunks need to save / restore callee save "tag" registers
+ https://bugs.webkit.org/show_bug.cgi?id=148345
+
+ Reviewed by Basile Clement.
+
+ Since these thunks can be called by FTL compiled functions, we can't count on the
+ tagTypeNumberRegister and tagMaskRegister. In fact, the same registers could be used
+ for other purposes. Since they are callee saves, save the current values on entry to
+ these thunks and materialize the tag constant values. On function exit we restore
+ the caller's values.
+
+ * jit/SpecializedThunkJIT.h:
+ (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+ (JSC::SpecializedThunkJIT::loadDoubleArgument):
+ (JSC::SpecializedThunkJIT::returnJSValue):
+ (JSC::SpecializedThunkJIT::returnDouble):
+ (JSC::SpecializedThunkJIT::returnInt32):
+ (JSC::SpecializedThunkJIT::returnJSCell):
+ (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
+ (JSC::SpecializedThunkJIT::emitSaveThenMaterializeTagRegisters):
+ (JSC::SpecializedThunkJIT::emitRestoreSavedTagRegisters):
+ (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+ * jit/ThunkGenerators.cpp:
+ (JSC::nativeForGenerator): Since the nativeForGenerator can be called via a tail call
+ by various specialized thunks, we need to restore the values of the tag constant callee
+ save registers. The specialized thunks is the only code that make such tail calls
+ to nativeForGenerator generated code.
+
</ins><span class="cx"> 2015-08-24 Basile Clement <basile_clement@apple.com>
</span><span class="cx">
</span><span class="cx"> jsc-tailcall: We can't assert that registers are flushed when making a tail call
</span></span></pre></div>
<a id="branchesjsctailcallSourceJavaScriptCorejitSpecializedThunkJITh"></a>
<div class="modfile"><h4>Modified: branches/jsc-tailcall/Source/JavaScriptCore/jit/SpecializedThunkJIT.h (188888 => 188889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsc-tailcall/Source/JavaScriptCore/jit/SpecializedThunkJIT.h 2015-08-24 21:56:38 UTC (rev 188888)
+++ branches/jsc-tailcall/Source/JavaScriptCore/jit/SpecializedThunkJIT.h 2015-08-24 22:40:45 UTC (rev 188889)
</span><span class="lines">@@ -44,6 +44,7 @@
</span><span class="cx"> : JSInterfaceJIT(vm)
</span><span class="cx"> {
</span><span class="cx"> emitFunctionPrologue();
</span><ins>+ emitSaveThenMaterializeTagRegisters();
</ins><span class="cx"> // Check that we have the expected number of arguments
</span><span class="cx"> m_failures.append(branch32(NotEqual, payloadFor(JSStack::ArgumentCount), TrustedImm32(expectedArgCount + 1)));
</span><span class="cx"> }
</span><span class="lines">@@ -52,6 +53,7 @@
</span><span class="cx"> : JSInterfaceJIT(vm)
</span><span class="cx"> {
</span><span class="cx"> emitFunctionPrologue();
</span><ins>+ emitSaveThenMaterializeTagRegisters();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void loadDoubleArgument(int argument, FPRegisterID dst, RegisterID scratch)
</span><span class="lines">@@ -105,6 +107,8 @@
</span><span class="cx"> {
</span><span class="cx"> if (src != regT0)
</span><span class="cx"> move(src, regT0);
</span><ins>+
+ emitRestoreSavedTagRegisters();
</ins><span class="cx"> emitFunctionEpilogue();
</span><span class="cx"> ret();
</span><span class="cx"> }
</span><span class="lines">@@ -113,6 +117,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT_UNUSED(payload, payload == regT0);
</span><span class="cx"> ASSERT_UNUSED(tag, tag == regT1);
</span><ins>+ emitRestoreSavedTagRegisters();
</ins><span class="cx"> emitFunctionEpilogue();
</span><span class="cx"> ret();
</span><span class="cx"> }
</span><span class="lines">@@ -137,6 +142,7 @@
</span><span class="cx"> lowNonZero.link(this);
</span><span class="cx"> highNonZero.link(this);
</span><span class="cx"> #endif
</span><ins>+ emitRestoreSavedTagRegisters();
</ins><span class="cx"> emitFunctionEpilogue();
</span><span class="cx"> ret();
</span><span class="cx"> }
</span><span class="lines">@@ -146,6 +152,7 @@
</span><span class="cx"> if (src != regT0)
</span><span class="cx"> move(src, regT0);
</span><span class="cx"> tagReturnAsInt32();
</span><ins>+ emitRestoreSavedTagRegisters();
</ins><span class="cx"> emitFunctionEpilogue();
</span><span class="cx"> ret();
</span><span class="cx"> }
</span><span class="lines">@@ -155,6 +162,7 @@
</span><span class="cx"> if (src != regT0)
</span><span class="cx"> move(src, regT0);
</span><span class="cx"> tagReturnAsJSCell();
</span><ins>+ emitRestoreSavedTagRegisters();
</ins><span class="cx"> emitFunctionEpilogue();
</span><span class="cx"> ret();
</span><span class="cx"> }
</span><span class="lines">@@ -185,7 +193,31 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span><ins>+ void emitSaveThenMaterializeTagRegisters()
+ {
+#if USE(JSVALUE64)
+#if CPU(ARM64)
+ pushPair(tagTypeNumberRegister, tagMaskRegister);
+#else
+ push(tagTypeNumberRegister);
+ push(tagMaskRegister);
+#endif
+ emitMaterializeTagCheckRegisters();
+#endif
+ }
</ins><span class="cx">
</span><ins>+ void emitRestoreSavedTagRegisters()
+ {
+#if USE(JSVALUE64)
+#if CPU(ARM64)
+ popPair(tagTypeNumberRegister, tagMaskRegister);
+#else
+ pop(tagMaskRegister);
+ pop(tagTypeNumberRegister);
+#endif
+#endif
+ }
+
</ins><span class="cx"> void tagReturnAsInt32()
</span><span class="cx"> {
</span><span class="cx"> #if USE(JSVALUE64)
</span></span></pre></div>
<a id="branchesjsctailcallSourceJavaScriptCorejitThunkGeneratorscpp"></a>
<div class="modfile"><h4>Modified: branches/jsc-tailcall/Source/JavaScriptCore/jit/ThunkGenerators.cpp (188888 => 188889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsc-tailcall/Source/JavaScriptCore/jit/ThunkGenerators.cpp 2015-08-24 21:56:38 UTC (rev 188888)
+++ branches/jsc-tailcall/Source/JavaScriptCore/jit/ThunkGenerators.cpp 2015-08-24 22:40:45 UTC (rev 188889)
</span><span class="lines">@@ -223,6 +223,18 @@
</span><span class="cx">
</span><span class="cx"> if (entryType == EnterViaCall)
</span><span class="cx"> jit.emitFunctionPrologue();
</span><ins>+#if USE(JSVALUE64)
+ else if (entryType == EnterViaJump) {
+ // We're coming from a specialized thunk that has saved the prior tag registers' contents.
+ // Restore them now.
+#if CPU(ARM64)
+ jit.popPair(JSInterfaceJIT::tagTypeNumberRegister, JSInterfaceJIT::tagMaskRegister);
+#else
+ jit.pop(JSInterfaceJIT::tagMaskRegister);
+ jit.pop(JSInterfaceJIT::tagTypeNumberRegister);
+#endif
+ }
+#endif
</ins><span class="cx">
</span><span class="cx"> jit.emitPutImmediateToCallFrameHeader(0, JSStack::CodeBlock);
</span><span class="cx"> jit.storePtr(JSInterfaceJIT::callFrameRegister, &vm->topCallFrame);
</span></span></pre>
</div>
</div>
</body>
</html>