Currently we do strange things around JITOperations calls: - We always check exception even if we don't have to. - Baseline JIT updates the top callframe on the JIT side, which is sort of good because it readily has the VM pointer. But then most of the JITOperations also update the top callframe anyway. - JITOperations don't have ready access to the JSGlobalObject* or the VM&. When they get the JSGlobalObject*, they often do it incorrectly. This is also tracked separately here: https://bugs.webkit.org/show_bug.cgi?id=154874 It seems that: JITOperations should be passed the JSGlobalObject* in addition to the callframe. The baseline JIT should never update top callframe on the JIT side - it's a waste of instructions. JITOperations should get the VM& from the JSGlobalObject*.
(In reply to comment #0) > Currently we do strange things around JITOperations calls: > > - We always check exception even if we don't have to. > > - Baseline JIT updates the top callframe on the JIT side, which is sort of > good because it readily has the VM pointer. But then most of the > JITOperations also update the top callframe anyway. > > - JITOperations don't have ready access to the JSGlobalObject* or the VM&. > When they get the JSGlobalObject*, they often do it incorrectly. This is > also tracked separately here: https://bugs.webkit.org/show_bug.cgi?id=154874 > > It seems that: > > JITOperations should be passed the JSGlobalObject* in addition to the > callframe. The baseline JIT should never update top callframe on the JIT > side - it's a waste of instructions. JITOperations should get the VM& from > the JSGlobalObject*. I wish we had a better data structure for talking about JITOperations. That could help with us removing the crazy code that is in DFGSpeculativeJIT.h We could also remove our weird naming that is there to give us a facade of type safety and instead turn them into debug assertions. We could also declare if an operation throws an exception so the JIT code we emit can do the right thing.