jsc-tailcall: Exceptions should properly restore callee save register contents during unwinding

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[Michael Saboff]

When we unwind to a catch block or uncaught exception code, callee save registers should be restored to their proper values.

[Michael Saboff]

Created attachment 258398 [details]
Patch

[Basile Clement]

Comment on attachment 258398 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=258398&action=review

LGTM.

> Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp:260
> +    m_jit.emitMaterializeTagCheckRegisters();
> +

I'd add a comment to state that we need the tag check registers to be materialized for the recoveries below.

> Source/JavaScriptCore/jit/AssemblyHelpers.h:228
> +        move(TrustedImmPtr(m_vm), temp1);
> +        addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1);

Why not just move(TrustedImmPtr(m_vm->calleeSaveRegistersBuffer), temp1);?

> Source/JavaScriptCore/jit/AssemblyHelpers.h:243
> +        move(TrustedImmPtr(m_vm), temp1);
> +        addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1);

Ditto.

> Source/JavaScriptCore/jit/AssemblyHelpers.h:263
> +        move(TrustedImmPtr(m_vm), temp1);
> +        addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1);

Ditto.

[Michael Saboff]

(In reply to comment #2)
> Comment on attachment 258398 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=258398&action=review
> 
> LGTM.
> 
> > Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp:260
> > +    m_jit.emitMaterializeTagCheckRegisters();
> > +
> 
> I'd add a comment to state that we need the tag check registers to be
> materialized for the recoveries below.
> 
> > Source/JavaScriptCore/jit/AssemblyHelpers.h:228
> > +        move(TrustedImmPtr(m_vm), temp1);
> > +        addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1);
> 
> Why not just move(TrustedImmPtr(m_vm->calleeSaveRegistersBuffer), temp1);?
> 
> > Source/JavaScriptCore/jit/AssemblyHelpers.h:243
> > +        move(TrustedImmPtr(m_vm), temp1);
> > +        addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1);
> 
> Ditto.
> 
> > Source/JavaScriptCore/jit/AssemblyHelpers.h:263
> > +        move(TrustedImmPtr(m_vm), temp1);
> > +        addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1);
> 
> Ditto.

I made the suggested changes locally.

[Michael Saboff]

Committed r188071: <http://trac.webkit.org/changeset/188071>

[Basile Clement]

*** This bug has been marked as a duplicate of bug 148666 ***

[Csaba Osztrogonác]

Comment on attachment 258398 [details]
Patch

Cleared review? from attachment 258398 [details] so that this bug does not appear in http://webkit.org/pending-review.  If you would like this patch reviewed, please attach it to a new bug (or re-open this bug before marking it for review again).