- Revision
- 264804
- Author
- [email protected]
- Date
- 2020-07-23 16:08:19 -0700 (Thu, 23 Jul 2020)
Log Message
[JSC] FTL OSR entry should store boxed |this|
https://bugs.webkit.org/show_bug.cgi?id=214675
<rdar://problem/65474072>
Reviewed by Michael Saboff and Mark Lam.
In this patch, after ensuring that we will go to FTL OSR entry, we store boxed |this| instead of the unboxed value
to agree to the FTL assumption that all arguments should be boxed.
* dfg/DFGOperations.cpp:
* ftl/FTLOSREntry.cpp:
(JSC::FTL::prepareOSREntry):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (264803 => 264804)
--- trunk/Source/_javascript_Core/ChangeLog 2020-07-23 22:48:27 UTC (rev 264803)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-07-23 23:08:19 UTC (rev 264804)
@@ -1,5 +1,20 @@
2020-07-23 Yusuke Suzuki <[email protected]>
+ [JSC] FTL OSR entry should store boxed |this|
+ https://bugs.webkit.org/show_bug.cgi?id=214675
+ <rdar://problem/65474072>
+
+ Reviewed by Michael Saboff and Mark Lam.
+
+ In this patch, after ensuring that we will go to FTL OSR entry, we store boxed |this| instead of the unboxed value
+ to agree to the FTL assumption that all arguments should be boxed.
+
+ * dfg/DFGOperations.cpp:
+ * ftl/FTLOSREntry.cpp:
+ (JSC::FTL::prepareOSREntry):
+
+2020-07-23 Yusuke Suzuki <[email protected]>
+
[JSC] BigInt can be `false` in boolean context in DFG AI
https://bugs.webkit.org/show_bug.cgi?id=214678
<rdar://problem/65894751>
Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.cpp (264803 => 264804)
--- trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2020-07-23 22:48:27 UTC (rev 264803)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2020-07-23 23:08:19 UTC (rev 264804)
@@ -3757,6 +3757,8 @@
unsigned streamIndex = iter->value;
if (CodeBlock* entryBlock = jitCode->osrEntryBlock()) {
dataLogLnIf(Options::verboseOSR(), "OSR entry: From ", RawPointer(jitCode), " got entry block ", RawPointer(entryBlock));
+ // If FTL::prepareOSREntry returns address, we must perform OSR entry since it already set up environment for FTL.
+ ASSERT(canOSREnterHere);
if (void* address = FTL::prepareOSREntry(vm, callFrame, codeBlock, entryBlock, originBytecodeIndex, streamIndex)) {
CODEBLOCK_LOG_EVENT(entryBlock, "osrEntry", ("at ", originBytecodeIndex));
return retagCodePtr<char*>(address, JSEntryPtrTag, bitwise_cast<PtrTag>(callFrame));
@@ -3909,6 +3911,8 @@
// We signal to try again after a while if that happens.
dataLogLnIf(Options::verboseOSR(), "Immediate OSR entry: From ", RawPointer(jitCode), " got entry block ", RawPointer(jitCode->osrEntryBlock()));
+ // If FTL::prepareOSREntry returns address, we must perform OSR entry since it already set up environment for FTL.
+ ASSERT(canOSREnterHere);
void* address = FTL::prepareOSREntry(vm, callFrame, codeBlock, jitCode->osrEntryBlock(), originBytecodeIndex, streamIndex);
if (!address)
return nullptr;
Modified: trunk/Source/_javascript_Core/ftl/FTLOSREntry.cpp (264803 => 264804)
--- trunk/Source/_javascript_Core/ftl/FTLOSREntry.cpp 2020-07-23 22:48:27 UTC (rev 264803)
+++ trunk/Source/_javascript_Core/ftl/FTLOSREntry.cpp 2020-07-23 23:08:19 UTC (rev 264804)
@@ -70,11 +70,18 @@
dataLogLnIf(Options::verboseOSR(), " Values at entry: ", values);
+ Optional<JSValue> reconstructedThis;
for (int argument = values.numberOfArguments(); argument--;) {
JSValue valueOnStack = callFrame->r(virtualRegisterForArgumentIncludingThis(argument)).asanUnsafeJSValue();
Optional<JSValue> reconstructedValue = values.argument(argument);
- if ((reconstructedValue && valueOnStack == reconstructedValue.value()) || !argument)
+ if (!argument) {
+ // |this| argument can be unboxed. We should store boxed value instead for loop OSR entry since FTL assumes that all arguments are flushed JSValue.
+ // To make this valid, we will modify the stack on the fly: replacing the value with boxed value.
+ reconstructedThis = reconstructedValue;
continue;
+ }
+ if (reconstructedValue && valueOnStack == reconstructedValue.value())
+ continue;
dataLog("Mismatch between reconstructed values and the value on the stack for argument arg", argument, " for ", *entryCodeBlock, " at ", bytecodeIndex, ":\n");
dataLog(" Value on stack: ", valueOnStack, "\n");
dataLog(" Reconstructed value: ", reconstructedValue, "\n");
@@ -105,6 +112,12 @@
void* result = entryCode->addressForCall(ArityCheckNotRequired).executableAddress();
dataLogLnIf(Options::verboseOSR(), " Entry will succeed, going to address ", RawPointer(result));
+
+ // At this point, we're committed to triggering an OSR entry immediately after we return. Hence, it is safe to modify stack here.
+ if (result) {
+ if (reconstructedThis)
+ callFrame->r(virtualRegisterForArgumentIncludingThis(0)) = JSValue::encode(reconstructedThis.value());
+ }
return result;
}
