<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:sbarati@apple.com" title="Saam Barati <sbarati@apple.com>"> <span class="fn">Saam Barati</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - Rethink the JITOperations calling convention"
href="https://bugs.webkit.org/show_bug.cgi?id=155693">bug 155693</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>sbarati@apple.com
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Rethink the JITOperations calling convention"
href="https://bugs.webkit.org/show_bug.cgi?id=155693#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Rethink the JITOperations calling convention"
href="https://bugs.webkit.org/show_bug.cgi?id=155693">bug 155693</a>
from <span class="vcard"><a class="email" href="mailto:sbarati@apple.com" title="Saam Barati <sbarati@apple.com>"> <span class="fn">Saam Barati</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=155693#c0">comment #0</a>)
<span class="quote">> Currently we do strange things around JITOperations calls:
>
> - We always check exception even if we don't have to.
>
> - Baseline JIT updates the top callframe on the JIT side, which is sort of
> good because it readily has the VM pointer. But then most of the
> JITOperations also update the top callframe anyway.
>
> - JITOperations don't have ready access to the JSGlobalObject* or the VM&.
> When they get the JSGlobalObject*, they often do it incorrectly. This is
> also tracked separately here: <a class="bz_bug_link
bz_status_NEW "
title="NEW - DFG intrinsics and operations play fast and loose with the lexical global object"
href="show_bug.cgi?id=154874">https://bugs.webkit.org/show_bug.cgi?id=154874</a>
>
> It seems that:
>
> JITOperations should be passed the JSGlobalObject* in addition to the
> callframe. The baseline JIT should never update top callframe on the JIT
> side - it's a waste of instructions. JITOperations should get the VM& from
> the JSGlobalObject*.</span >
I wish we had a better data structure for talking about JITOperations.
That could help with us removing the crazy code that is in DFGSpeculativeJIT.h
We could also remove our weird naming that is there to give us a facade of type
safety and instead turn them into debug assertions. We could also declare if an operation throws an exception so the JIT code we emit can do the right thing.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>