Modified: branches/jsc-tailcall/Source/_javascript_Core/ChangeLog (187669 => 187670)
--- branches/jsc-tailcall/Source/_javascript_Core/ChangeLog 2015-07-31 19:43:43 UTC (rev 187669)
+++ branches/jsc-tailcall/Source/_javascript_Core/ChangeLog 2015-07-31 20:01:59 UTC (rev 187670)
@@ -1,3 +1,15 @@
+2015-07-31 Michael Saboff <[email protected]>
+
+ jsc-tailcall:Eliminate the unsafe use of regT5 in arityFixupGenerator() for X86-64 Windows
+ https://bugs.webkit.org/show_bug.cgi?id=147499
+
+ Reviewed by Basile Clement.
+
+ For X86-64, Windows, regT0 is free so use that register instead of regT5.
+
+ * jit/ThunkGenerators.cpp:
+ (JSC::arityFixupGenerator):
+
2015-07-30 Michael Saboff <[email protected]>
jsc-tailcall: LLint, Baseline and DFG JIT should save & restore platform's callee-save registers
Modified: branches/jsc-tailcall/Source/_javascript_Core/jit/ThunkGenerators.cpp (187669 => 187670)
--- branches/jsc-tailcall/Source/_javascript_Core/jit/ThunkGenerators.cpp 2015-07-31 19:43:43 UTC (rev 187669)
+++ branches/jsc-tailcall/Source/_javascript_Core/jit/ThunkGenerators.cpp 2015-07-31 20:01:59 UTC (rev 187670)
@@ -365,8 +365,13 @@
JSInterfaceJIT jit(vm);
// We enter with fixup count, in aligned stack units, in argumentGPR0 and the return thunk in argumentGPR1
- // We have the guarantee that a0, a1, a2, t3, t4 and t5 are all distinct :-)
+ // We have the guarantee that a0, a1, a2, t3, t4 and t5 (or t0 for Windows) are all distinct :-)
#if USE(JSVALUE64)
+#if OS(WINDOWS)
+ const GPRReg extraTemp = JSInterfaceJIT::regT0;
+#else
+ const GPRReg extraTemp = JSInterfaceJIT::regT5;
+#endif
# if CPU(X86_64)
jit.pop(JSInterfaceJIT::regT4);
# endif
@@ -378,25 +383,25 @@
// Move current frame down argumentGPR0 number of slots
JSInterfaceJIT::Label copyLoop(jit.label());
- jit.load64(JSInterfaceJIT::regT3, JSInterfaceJIT::regT5);
- jit.store64(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight));
+ jit.load64(JSInterfaceJIT::regT3, extraTemp);
+ jit.store64(extraTemp, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight));
jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2).linkTo(copyLoop, &jit);
// Fill in argumentGPR0 - 1 missing arg slots with undefined
jit.move(JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::argumentGPR2);
- jit.move(JSInterfaceJIT::TrustedImm64(ValueUndefined), JSInterfaceJIT::regT5);
+ jit.move(JSInterfaceJIT::TrustedImm64(ValueUndefined), extraTemp);
jit.add32(JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2);
JSInterfaceJIT::Label fillUndefinedLoop(jit.label());
- jit.store64(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight));
+ jit.store64(extraTemp, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight));
jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2).linkTo(fillUndefinedLoop, &jit);
// Adjust call frame register and stack pointer to account for missing args
- jit.move(JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::regT5);
- jit.lshift64(JSInterfaceJIT::TrustedImm32(3), JSInterfaceJIT::regT5);
- jit.addPtr(JSInterfaceJIT::regT5, JSInterfaceJIT::callFrameRegister);
- jit.addPtr(JSInterfaceJIT::regT5, JSInterfaceJIT::stackPointerRegister);
+ jit.move(JSInterfaceJIT::argumentGPR0, extraTemp);
+ jit.lshift64(JSInterfaceJIT::TrustedImm32(3), extraTemp);
+ jit.addPtr(extraTemp, JSInterfaceJIT::callFrameRegister);
+ jit.addPtr(extraTemp, JSInterfaceJIT::stackPointerRegister);
# if CPU(X86_64)
jit.push(JSInterfaceJIT::regT4);
