[Webkit-unassigned] [Bug 190656] useProbeOSRExit causes failures for Win64 DFG JIT

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=190656

--- Comment #6 from Ross Kirsling <ross.kirsling at sony.com> ---
(In reply to Ross Kirsling from comment #5)
> As such, if we hack in a `exitState.stackPointerOffset -= 0x40;` line right
> before setting RSP in executeOSRExit, the test case succeeds:
> https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/dfg/
> DFGOSRExit.cpp#L437

To put this last part a bit more clearly, if we add 8 to the variable count returned from the DFG::VariableEventStream::reconstruct call here:
https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/dfg/DFGOSRExit.cpp#L401

And comment out a sanity-check assert for Probe::Stack::lowWatermark here:
https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/assembler/ProbeStack.h#L156

Then we finally have a state in which all the failing dfg-eager tests pass.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20181026/dd1d214c/attachment-0001.html>