Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Cherry-pick dd1c094. rdar://122345846
[JSC] Suppress broken assertion in DFG register allocation https://bugs.webkit.org/show_bug.cgi?id=268727 rdar://122279383 Reviewed by Mark Lam. DFG register allocation check's assertion is broken. It records register-allocation offset, and attempt to do assert when jump is going over it. But this does not work at all if register allocation does not emit any instructions. In that case, the offset can be valid instruction' one after the register allocation is done. And this is what is happening here. We workaround this silly bug by reordering instruction and jump target a bit. emitStoreCallSiteIndex always emits some instructions, so it distinguishes register allocation offset from the actual one. And when retrying (jumping to mainPath), we do not need to perform emitStoreCallSiteIndex again. * Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): Canonical link: https://commits.webkit.org/274116@main Canonical link: https://commits.webkit.org/274066.9@safari-7619.1.3-branch
- Loading branch information