The specialized thunks, like charAt use the tagTypeNumberRegister and/or tagMaskRegister. These are both callee saves, but the thunks assume that they have the special values. If the thunk is called by an FTL generated function, those registers do not have the right value. At the beginning of these thunks, the current values need to be saved and the tag values materialized. The values need to be restores before returning from the thunk.
Created attachment 259731 [details] Patch
Comment on attachment 259731 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=259731&action=review LGTM > Source/JavaScriptCore/jit/SpecializedThunkJIT.h:196 > + void emitSaveTagCalleeSavesAndMaterializeTagRegisters() Nit: Maybe it's just because English is not my native language, but this name was confusing to me as I read it as "emit save, tag callee saves, and materialize tag registers". Maybe something like "emitSaveThenMaterializeTagRegisters" would be clearer, I don't know. > Source/JavaScriptCore/jit/ThunkGenerators.cpp:227 > + else if (entryType == EnterViaJump) { Just curious, would it be hard to do the register restoration before the jump instead? It would probably be a less contrived dependency (and wouldn't prevent jumping from places that didn't save the tag registers).
(In reply to comment #2) > Comment on attachment 259731 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=259731&action=review > > LGTM > > > Source/JavaScriptCore/jit/SpecializedThunkJIT.h:196 > > + void emitSaveTagCalleeSavesAndMaterializeTagRegisters() > > Nit: Maybe it's just because English is not my native language, but this > name was confusing to me as I read it as "emit save, tag callee saves, and > materialize tag registers". Maybe something like > "emitSaveThenMaterializeTagRegisters" would be clearer, I don't know. I'll rename this and the other function to emitSaveThenMaterializeTagRegisters() and emitRestoreSavedTagRegisters(). > > Source/JavaScriptCore/jit/ThunkGenerators.cpp:227 > > + else if (entryType == EnterViaJump) { > > Just curious, would it be hard to do the register restoration before the > jump instead? It would probably be a less contrived dependency (and wouldn't > prevent jumping from places that didn't save the tag registers). The problem is that most of the places where we tailCall (EnterViaJump) to this thunk are from conditional jumps. We could create some other common landing place to jump to, restore the callee saves and then jump here, but the specialized thunks are the only place that uses the EnterViaJump path.
Committed r188889: <http://trac.webkit.org/changeset/188889>
*** This bug has been marked as a duplicate of bug 148666 ***
Comment on attachment 259731 [details] Patch Cleared review? from attachment 259731 [details] so that this bug does not appear in http://webkit.org/pending-review. If you would like this patch reviewed, please attach it to a new bug (or re-open this bug before marking it for review again).