Bug 171079 – virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark Lam]

This is because tail calls would restore callee saved registers (and therefore, potentially clobber the tag registers) before jumping to the thunk.

<rdar://problem/31684756>

[Mark Lam]

Created attachment 307654 [details]
proposed patch.

[Saam Barati]

Comment on attachment 307654 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=307654&action=review

r=me

> Source/JavaScriptCore/jit/AssemblyHelpers.h:429
> +    void emitMaterializeTagMaskInRegister(GPRReg reg)
> +    {
> +        move(MacroAssembler::TrustedImm64(TagTypeNumber), reg);
> +        orPtr(MacroAssembler::TrustedImm32(TagBitTypeOther), reg, reg);
> +    }

Please verify this is less code on X86_64 and ARM64, otherwise, please specialize to those platforms what you do such that we emit less code.

[Mark Lam]

(In reply to Saam Barati from comment #2)
> Comment on attachment 307654 [details]
> proposed patch.
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=307654&action=review
> 
> r=me
> 
> > Source/JavaScriptCore/jit/AssemblyHelpers.h:429
> > +    void emitMaterializeTagMaskInRegister(GPRReg reg)
> > +    {
> > +        move(MacroAssembler::TrustedImm64(TagTypeNumber), reg);
> > +        orPtr(MacroAssembler::TrustedImm32(TagBitTypeOther), reg, reg);
> > +    }
> 
> Please verify this is less code on X86_64 and ARM64, otherwise, please
> specialize to those platforms what you do such that we emit less code.

I think it's better to use a single instruction.  I'll switch to doing that.

[Mark Lam]

Created attachment 307658 [details]
patch for landing.

[Mark Lam]

Thanks for the review.  Landed in r215596: <http://trac.webkit.org/r215596>.