When we unwind to a catch block or uncaught exception code, callee save registers should be restored to their proper values.
Created attachment 258398 [details] Patch
Comment on attachment 258398 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=258398&action=review LGTM. > Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp:260 > + m_jit.emitMaterializeTagCheckRegisters(); > + I'd add a comment to state that we need the tag check registers to be materialized for the recoveries below. > Source/JavaScriptCore/jit/AssemblyHelpers.h:228 > + move(TrustedImmPtr(m_vm), temp1); > + addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1); Why not just move(TrustedImmPtr(m_vm->calleeSaveRegistersBuffer), temp1);? > Source/JavaScriptCore/jit/AssemblyHelpers.h:243 > + move(TrustedImmPtr(m_vm), temp1); > + addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1); Ditto. > Source/JavaScriptCore/jit/AssemblyHelpers.h:263 > + move(TrustedImmPtr(m_vm), temp1); > + addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1); Ditto.
(In reply to comment #2) > Comment on attachment 258398 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=258398&action=review > > LGTM. > > > Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp:260 > > + m_jit.emitMaterializeTagCheckRegisters(); > > + > > I'd add a comment to state that we need the tag check registers to be > materialized for the recoveries below. > > > Source/JavaScriptCore/jit/AssemblyHelpers.h:228 > > + move(TrustedImmPtr(m_vm), temp1); > > + addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1); > > Why not just move(TrustedImmPtr(m_vm->calleeSaveRegistersBuffer), temp1);? > > > Source/JavaScriptCore/jit/AssemblyHelpers.h:243 > > + move(TrustedImmPtr(m_vm), temp1); > > + addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1); > > Ditto. > > > Source/JavaScriptCore/jit/AssemblyHelpers.h:263 > > + move(TrustedImmPtr(m_vm), temp1); > > + addPtr(TrustedImm32(VM::calleeSaveRegistersBufferOffset()), temp1); > > Ditto. I made the suggested changes locally.
Committed r188071: <http://trac.webkit.org/changeset/188071>
*** This bug has been marked as a duplicate of bug 148666 ***
Comment on attachment 258398 [details] Patch Cleared review? from attachment 258398 [details] so that this bug does not appear in http://webkit.org/pending-review. If you would like this patch reviewed, please attach it to a new bug (or re-open this bug before marking it for review again).