Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7f93c606efccc5df180d461167efe78f1824ffb8
https://github.com/WebKit/WebKit/commit/7f93c606efccc5df180d461167efe78f1824ffb8
Author: Justin Michaud <[email protected]>
Date: 2024-04-25 (Thu, 25 Apr 2024)
Changed paths:
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/jit/CallFrameShuffler.h
Log Message:
-----------
Spurious assertion after direct call data ic on 32 bits
https://bugs.webkit.org/show_bug.cgi?id=273183
Reviewed by Yusuke Suzuki.
This assertion made sense before DataIC. It is asserting that we only see boxed
ints,
because unboxed ints should use the other version of the addNew method that
takes JSValueRegs.
Essentially, on 32-bit, we may have separate Tag and Payload recoveries that
should map to the same
cachedRecovery. When we iterate over each register in CallFrameShuffler(), we
lose this information, so
addNew really becomes addNew (or update the tag register).
Now though, recent DataIC changes mean the CallLinkInfo* needs to be mainained
by the call frame shuffler in the DirectTailCall case, unboxed. So, we just
move the assertion to
the case where it actually matters.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* Source/JavaScriptCore/jit/CallFrameShuffler.h:
(JSC::CallFrameShuffler::addNew):
Canonical link: https://commits.webkit.org/277977@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
