These byte codes currently use implicit exec->scope() to get there scope. This needs to be changed to use a passed in scope.
Created attachment 241505 [details] Patch
Comment on attachment 241505 [details] Patch r=me
Comment on attachment 241505 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=241505&action=review > Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:4519 > + SpeculateCellOperand scope(this, node->child2()); You don't want SpeculateCellOperand here; that will emit a branch to check that the scope is a cell, even though we are certain that it is a cell. > Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:4549 > + SpeculateCellOperand scope(this, node->child2()); Ditto. > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:4162 > + SpeculateCellOperand scope(this, node->child1()); Ditto. > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:4174 > + SpeculateCellOperand scope(this, node->child1()); Ditto.
(In reply to comment #3) > Comment on attachment 241505 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=241505&action=review > > > Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:4519 > > + SpeculateCellOperand scope(this, node->child2()); > > You don't want SpeculateCellOperand here; that will emit a branch to check > that the scope is a cell, even though we are certain that it is a cell. > > > Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:4549 > > + SpeculateCellOperand scope(this, node->child2()); > > Ditto. > > > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:4162 > > + SpeculateCellOperand scope(this, node->child1()); > > Ditto. > > > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:4174 > > + SpeculateCellOperand scope(this, node->child1()); > > Ditto. The way I read fillSpeculateCell(), we won't issue the check for DataFormatCell or DataFormatJSCell: case DataFormatCell: case DataFormatJSCell: { GPRReg gpr = info.gpr(); m_gprs.lock(gpr); if (!ASSERT_DISABLED) { MacroAssembler::Jump checkCell = branchIsCell(JSValueRegs(gpr)); m_jit.abortWithReason(DFGIsNotCell); checkCell.link(&m_jit); } return gpr; } I'm just following the existing pattern for other accesses to the scope chain. case SkipScope: { SpeculateCellOperand scope(this, node->child1()); GPRTemporary result(this, Reuse, scope); m_jit.loadPtr(JITCompiler::Address(scope.gpr(), JSScope::offsetOfNext()), result.gpr()); cellResult(result.gpr(), node); break; } case GetClosureRegisters: { ... SpeculateCellOperand scope(this, node->child1()); GPRTemporary result(this); GPRReg scopeGPR = scope.gpr(); GPRReg resultGPR = result.gpr(); The current code that uses the call frame ScopeChain register slot will either have the VirtualRegister as a cell or a constant. For non-inlined frames the child is from a GetMyScope node, which returns a cellResult. For inlined frames, child is from a JSConstant of the JSScope* value. Which won't create a check. When this work is done, op_get_scope will turn into a GetScope node which also has a cellResult.
Committed r176109: <http://trac.webkit.org/changeset/176109>