The DFG call out code constructs a new callee frame relative to the stack pointer. Currently before making a call, it decrements the stack pointer by 16 to have it point above the returnPC and caller frame slots. Instead, the stack pointer should be set properly at the top of the function so that the callee frame above the returnPC can be constructed relative to the stack pointer and then issue a call without adjusting the stack pointer.
Created attachment 219122 [details] Patch
Landed in 160506 on the jsCStack branch: <http://trac.webkit.org/160506>
Comment on attachment 219122 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=219122&action=review r=me > Source/JavaScriptCore/dfg/DFGGraph.cpp:706 > + unsigned result = m_nextMachineLocal + std::max(m_parameterSlots, (unsigned)JSStack::CallerFrameAndPCSize); static_cast, please. > Source/JavaScriptCore/dfg/DFGGraph.cpp:707 > result += result & 1; // Align the register count This would be better expressed as "result = roundUpToMultipleOf<stackAlignment>(result);", and no comment. > Source/JavaScriptCore/llint/LowLevelInterpreter.asm:44 > +const CallerFrameAndPCSize = 2 * PtrSize Please add an ASSERT for this to LLIntData.cpp.
Changes from review landed in 160514 on the jsCStack branch: <http://trac.webkit.org/160514 >