Commit d748daa3 authored by zhengxing.li's avatar zhengxing.li Committed by Commit bot

X87: [Interpreter] Fix incorrect frame walking in arguments create stubs.

  port 40f34541 (r36181)

  original commit message:
  The previous approach taken by FastNew[Sloppy,Strict,Rest]ArgumentsStub
  looked at the function slot in order to skip stub frames
  and find the JS frame. However, stub frames do not have a
  function slot (in fact their fixed frame ends one slot
  before the JS frame's function slot). Therefore, if this
  location in the stub frame happens to have the function
  object the create arguments stubs won't skip this frame
  correctly.

  Replace this approach with one where the stub is
  specialized to either skip a frame if required (since
  there will only ever be one extra frame on Ignition
  the loop approach isn't necessary).

BUG=

Review-Url: https://codereview.chromium.org/1976483002
Cr-Commit-Position: refs/heads/master@{#36197}
parent 26ea3707
...@@ -4478,19 +4478,19 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) { ...@@ -4478,19 +4478,19 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
// ----------------------------------- // -----------------------------------
__ AssertFunction(edi); __ AssertFunction(edi);
// For Ignition we need to skip all possible handler/stub frames until // Make edx point to the JavaScript frame.
// we reach the JavaScript frame for the function (similar to what the __ mov(edx, ebp);
// runtime fallback implementation does). So make edx point to that if (skip_stub_frame()) {
// JavaScript frame. // For Ignition we need to skip the handler/stub frame to reach the
{ // JavaScript frame for the function.
Label loop, loop_entry;
__ mov(edx, ebp);
__ jmp(&loop_entry, Label::kNear);
__ bind(&loop);
__ mov(edx, Operand(edx, StandardFrameConstants::kCallerFPOffset)); __ mov(edx, Operand(edx, StandardFrameConstants::kCallerFPOffset));
__ bind(&loop_entry); }
if (FLAG_debug_code) {
Label ok;
__ cmp(edi, Operand(edx, StandardFrameConstants::kFunctionOffset)); __ cmp(edi, Operand(edx, StandardFrameConstants::kFunctionOffset));
__ j(not_equal, &loop); __ j(equal, &ok);
__ Abort(kInvalidFrameForFastNewRestArgumentsStub);
__ bind(&ok);
} }
// Check if we have rest parameters (only possible if we have an // Check if we have rest parameters (only possible if we have an
...@@ -4624,19 +4624,19 @@ void FastNewSloppyArgumentsStub::Generate(MacroAssembler* masm) { ...@@ -4624,19 +4624,19 @@ void FastNewSloppyArgumentsStub::Generate(MacroAssembler* masm) {
// ----------------------------------- // -----------------------------------
__ AssertFunction(edi); __ AssertFunction(edi);
// For Ignition we need to skip all possible handler/stub frames until // Make ecx point to the JavaScript frame.
// we reach the JavaScript frame for the function (similar to what the __ mov(ecx, ebp);
// runtime fallback implementation does). So make ebx point to that if (skip_stub_frame()) {
// JavaScript frame. // For Ignition we need to skip the handler/stub frame to reach the
{ // JavaScript frame for the function.
Label loop, loop_entry;
__ mov(ecx, ebp);
__ jmp(&loop_entry, Label::kNear);
__ bind(&loop);
__ mov(ecx, Operand(ecx, StandardFrameConstants::kCallerFPOffset)); __ mov(ecx, Operand(ecx, StandardFrameConstants::kCallerFPOffset));
__ bind(&loop_entry); }
if (FLAG_debug_code) {
Label ok;
__ cmp(edi, Operand(ecx, StandardFrameConstants::kFunctionOffset)); __ cmp(edi, Operand(ecx, StandardFrameConstants::kFunctionOffset));
__ j(not_equal, &loop); __ j(equal, &ok);
__ Abort(kInvalidFrameForFastNewSloppyArgumentsStub);
__ bind(&ok);
} }
// TODO(bmeurer): Cleanup to match the FastNewStrictArgumentsStub. // TODO(bmeurer): Cleanup to match the FastNewStrictArgumentsStub.
...@@ -4879,19 +4879,19 @@ void FastNewStrictArgumentsStub::Generate(MacroAssembler* masm) { ...@@ -4879,19 +4879,19 @@ void FastNewStrictArgumentsStub::Generate(MacroAssembler* masm) {
// ----------------------------------- // -----------------------------------
__ AssertFunction(edi); __ AssertFunction(edi);
// For Ignition we need to skip all possible handler/stub frames until // Make edx point to the JavaScript frame.
// we reach the JavaScript frame for the function (similar to what the __ mov(edx, ebp);
// runtime fallback implementation does). So make edx point to that if (skip_stub_frame()) {
// JavaScript frame. // For Ignition we need to skip the handler/stub frame to reach the
{ // JavaScript frame for the function.
Label loop, loop_entry;
__ mov(edx, ebp);
__ jmp(&loop_entry, Label::kNear);
__ bind(&loop);
__ mov(edx, Operand(edx, StandardFrameConstants::kCallerFPOffset)); __ mov(edx, Operand(edx, StandardFrameConstants::kCallerFPOffset));
__ bind(&loop_entry); }
if (FLAG_debug_code) {
Label ok;
__ cmp(edi, Operand(edx, StandardFrameConstants::kFunctionOffset)); __ cmp(edi, Operand(edx, StandardFrameConstants::kFunctionOffset));
__ j(not_equal, &loop); __ j(equal, &ok);
__ Abort(kInvalidFrameForFastNewStrictArgumentsStub);
__ bind(&ok);
} }
// Check if we have an arguments adaptor frame below the function frame. // Check if we have an arguments adaptor frame below the function frame.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment