Bug 26164 – webkit/jit stack mis-aligned for double on MIPS platform

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: JavaScriptCore

[joe dai]

It is a block for MIPS and I've not found simple solution. Mips asks for 64bits aligned for double storage.

In privateCompileCTIMachineTrampolines() it frequently pop/push a 32bit register, which mis-aligns the stack if it is aligned to 64bit originally.
Further more, a void pointer can be used as argument to call Lexer::lex(void* p1, void* p2) then this pointer is converted a structure that contains double as member, this pointer can be mis-aligned also.

To reproduce, simply debug "jsc shell.js" and trace to int Lexer::lex(void* p1, void* p2) and you will see mis-aligned stack pointer and mis-aligned  doubledValue pointer in say: lvalp->doubleValue = dval;

I tried to write a small piece of inline asm to get rid the first case, but identify second case to make sure all double structure are properly aligned seems difficult.

[Gavin Barraclough]

Cannot reproduce a problem on ToT.

On OS X x86, the stack should always be 16-byte aligned prior to making a call, the call pushes the return address decrementing %esp by 4, and as such on function entry the %esp value should always containing a value ending in 0xC.  Adding a breakpoint to JSC::Lexer::lex & testing this, I observe correct behavior.  From visual code inspection of the machine trampolines, they are currently correctly implemented, and are not misaligning the stack.  When, during implementation, there have been alignment issues in the JIT these have causes crashes (memcpy can use aligned SSE accesses), as such we would expect to know.

Can you provide steps to reproduce a problem here?  Otherwise, marking this 'works for me'.