This is because tail calls would restore callee saved registers (and therefore, potentially clobber the tag registers) before jumping to the thunk. <rdar://problem/31684756>
Created attachment 307654 [details] proposed patch.
Comment on attachment 307654 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=307654&action=review r=me > Source/JavaScriptCore/jit/AssemblyHelpers.h:429 > + void emitMaterializeTagMaskInRegister(GPRReg reg) > + { > + move(MacroAssembler::TrustedImm64(TagTypeNumber), reg); > + orPtr(MacroAssembler::TrustedImm32(TagBitTypeOther), reg, reg); > + } Please verify this is less code on X86_64 and ARM64, otherwise, please specialize to those platforms what you do such that we emit less code.
(In reply to Saam Barati from comment #2) > Comment on attachment 307654 [details] > proposed patch. > > View in context: > https://bugs.webkit.org/attachment.cgi?id=307654&action=review > > r=me > > > Source/JavaScriptCore/jit/AssemblyHelpers.h:429 > > + void emitMaterializeTagMaskInRegister(GPRReg reg) > > + { > > + move(MacroAssembler::TrustedImm64(TagTypeNumber), reg); > > + orPtr(MacroAssembler::TrustedImm32(TagBitTypeOther), reg, reg); > > + } > > Please verify this is less code on X86_64 and ARM64, otherwise, please > specialize to those platforms what you do such that we emit less code. I think it's better to use a single instruction. I'll switch to doing that.
Created attachment 307658 [details] patch for landing.
Thanks for the review. Landed in r215596: <http://trac.webkit.org/r215596>.