Bug 147893 – jsc-tailcall: Arity fixup should make use of the possible extra empty slots at top of the frame

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Basile Clement]

This would:
 - Allow to not have to move the call frame when there is a single missing argument and the top of the frame was not aligned
 - Make computing the "real" frame simpler: any frame always has aligned size alignUp(max(argCount, numParameters) + CallFrameHeaderSize). Right now, the formula is quite contrived:
  alignUp(max(argCount, argCount + alignUp(numParameters - argCount)) + CallFrameHeaderSize)

[Basile Clement]

Created attachment 258786 [details]
Patch

[Michael Saboff]

Comment on attachment 258786 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=258786&action=review

r=me

> Source/JavaScriptCore/jit/ThunkGenerators.cpp:443
> +    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR2, JSInterfaceJIT::TimesEight));
> +    jit.move(JSInterfaceJIT::TrustedImm32(JSValue::UndefinedTag), JSInterfaceJIT::regT5);
> +    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR2, JSInterfaceJIT::TimesEight, 4));

Instead of no offset or 4 and even though the existing code does this, use OBJECT_OFFSETOF(JSValue, u.asBits.payload) and OBJECT_OFFSETOF(JSValue, u.asBits.tag).

[Basile Clement]

(In reply to comment #2)
> Comment on attachment 258786 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=258786&action=review
> 
> r=me
> 
> > Source/JavaScriptCore/jit/ThunkGenerators.cpp:443
> > +    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR2, JSInterfaceJIT::TimesEight));
> > +    jit.move(JSInterfaceJIT::TrustedImm32(JSValue::UndefinedTag), JSInterfaceJIT::regT5);
> > +    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR2, JSInterfaceJIT::TimesEight, 4));
> 
> Instead of no offset or 4 and even though the existing code does this, use
> OBJECT_OFFSETOF(JSValue, u.asBits.payload) and OBJECT_OFFSETOF(JSValue,
> u.asBits.tag).

Fixed locally (with the TagOffset and PayloadOffset shorthands).

[Basile Clement]

Committed r188318 <http://trac.webkit.org/changeset/188318>.