DFG Call/ConstructForwardVarargs fails to restore the stack pointer
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 21 Apr 2015 20:55:45 +0000 (20:55 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 21 Apr 2015 20:55:45 +0000 (20:55 +0000)
https://bugs.webkit.org/show_bug.cgi?id=144007

Reviewed by Mark Lam.

We were conditioning the stack pointer restoration on isVarargs, but we also need to do it
if isForwardVarargs.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* tests/stress/varargs-then-slow-call.js: Added.
(foo):
(bar):
(fuzz):
(baz):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183076 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/tests/stress/varargs-then-slow-call.js [new file with mode: 0644]

index 5811617..3aeabe3 100644 (file)
@@ -1,3 +1,23 @@
+2015-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Call/ConstructForwardVarargs fails to restore the stack pointer
+        https://bugs.webkit.org/show_bug.cgi?id=144007
+
+        Reviewed by Mark Lam.
+        
+        We were conditioning the stack pointer restoration on isVarargs, but we also need to do it
+        if isForwardVarargs.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * tests/stress/varargs-then-slow-call.js: Added.
+        (foo):
+        (bar):
+        (fuzz):
+        (baz):
+
 2015-04-21  Basile Clement  <basile_clement@apple.com>
 
         Remove AllocationProfileWatchpoint node
index 76018d8..1c218dc 100644 (file)
@@ -835,7 +835,7 @@ void SpeculativeJIT::emitCall(Node* node)
     m_jit.addJSCall(fastCall, slowCall, targetToCheck, info);
     
     // If we were varargs, then after the calls are done, we need to reestablish our stack pointer.
-    if (isVarargs)
+    if (isVarargs || isForwardVarargs)
         m_jit.addPtr(TrustedImm32(m_jit.graph().stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, JITCompiler::stackPointerRegister);
 }
 
index 96936bb..b48dcd4 100644 (file)
@@ -799,7 +799,7 @@ void SpeculativeJIT::emitCall(Node* node)
     m_jit.addJSCall(fastCall, slowCall, targetToCheck, callLinkInfo);
     
     // If we were varargs, then after the calls are done, we need to reestablish our stack pointer.
-    if (isVarargs)
+    if (isVarargs || isForwardVarargs)
         m_jit.addPtr(TrustedImm32(m_jit.graph().stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, JITCompiler::stackPointerRegister);
 }
 
diff --git a/Source/JavaScriptCore/tests/stress/varargs-then-slow-call.js b/Source/JavaScriptCore/tests/stress/varargs-then-slow-call.js
new file mode 100644 (file)
index 0000000..a766ae7
--- /dev/null
@@ -0,0 +1,40 @@
+function foo(a, b) {
+    return a + b;
+}
+noInline(foo);
+
+function bar() {
+    return foo.apply(this, arguments);
+}
+
+function fuzz(a, b, c, d, e, f) {
+    return a + b + c + d + e + f;
+}
+noInline(fuzz);
+
+function baz(array) {
+    var a = array[0];
+    var b = array[1];
+    var c = array[2];
+    var d = array[3];
+    var e = array[4];
+    var f = array[5];
+    var g = array[6];
+    var h = array[7];
+    var i = array[8];
+    var j = array[9];
+    
+    var x = bar(a, b);
+    var y = fuzz(a, b, c, d, e, f);
+    
+    return a + b + c + d + e + f + g + h + i + j + x + y;
+}
+
+noInline(baz);
+
+for (var i = 0; i < 10000; ++i) {
+    var result = baz([0, 1, 2, 3, 4, 5, 6, 7, 8, 9]);
+    if (result != 61)
+        throw "Error: bad result: " + result;
+}
+