Attachment #402781 for bug #213307

View Details Raw Unified Return to Bug 213307

| Differences between



2020-06-25  Yusuke Suzuki  <ysuzuki@apple.com>

        REGRESSION(r263035): stress/get-prototype-of.js broken on s390x
        https://bugs.webkit.org/show_bug.cgi?id=213307

        Reviewed by NOBODY (OOPS!).

        Structure::m_outOfLineTypeFlags is uint16_t. If we access this field as 32bit field, we have different value in big endian architectures.
        Since we do not have half-size-load branch instructions, we should load this uint16_t value via `loadh` (which zero-extends the loaded value)
        and perform branch onto that value.

        * llint/LowLevelInterpreter64.asm:

2020-06-24  Ross Kirsling  <ross.kirsling@sony.com>

        [Intl] Disprefer using ICU enums directly as instance variables



    bbb JSCell::m_type[t0], ObjectType, .opGetPrototypeOfSlow

    loadStructureWithScratch(t0, t2, t1, t3)
    loadh Structure::m_outOfLineTypeFlags[t2], t3
    btinz t3, OverridesGetPrototypeOutOfLine, .opGetPrototypeOfSlow

    loadq Structure::m_prototype[t2], t2
    btqz t2, .opGetPrototypeOfPolyProto

Return to Bug 213307

Lines 1509-1515 llintOpWithProfile(op_get_prototype_of, OpGetPrototypeOf, macro (size, get, disp a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec1
- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm -1 / +2 lines
1509	bbb JSCell::m_type[t0], ObjectType, .opGetPrototypeOfSlow	1509	bbb JSCell::m_type[t0], ObjectType, .opGetPrototypeOfSlow
1510		1510
1511	loadStructureWithScratch(t0, t2, t1, t3)	1511	loadStructureWithScratch(t0, t2, t1, t3)
1512	btinz Structure::m_outOfLineTypeFlags[t2], OverridesGetPrototypeOutOfLine, .opGetPrototypeOfSlow	1512	loadh Structure::m_outOfLineTypeFlags[t2], t3
		1513	btinz t3, OverridesGetPrototypeOutOfLine, .opGetPrototypeOfSlow
1513		1514
1514	loadq Structure::m_prototype[t2], t2	1515	loadq Structure::m_prototype[t2], t2
1515	btqz t2, .opGetPrototypeOfPolyProto	1516	btqz t2, .opGetPrototypeOfPolyProto

Lines 1-3 a/Source/JavaScriptCore/ChangeLog_sec1
- a/Source/JavaScriptCore/ChangeLog +13 lines
		1	2020-06-25 Yusuke Suzuki <ysuzuki@apple.com>
		2
		3	REGRESSION(r263035): stress/get-prototype-of.js broken on s390x
		4	https://bugs.webkit.org/show_bug.cgi?id=213307
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Structure::m_outOfLineTypeFlags is uint16_t. If we access this field as 32bit field, we have different value in big endian architectures.
		9	Since we do not have half-size-load branch instructions, we should load this uint16_t value via `loadh` (which zero-extends the loaded value)
		10	and perform branch onto that value.
		11
		12	* llint/LowLevelInterpreter64.asm:
		13
1	2020-06-24 Ross Kirsling <ross.kirsling@sony.com>	14	2020-06-24 Ross Kirsling <ross.kirsling@sony.com>
2		15
3	[Intl] Disprefer using ICU enums directly as instance variables	16	[Intl] Disprefer using ICU enums directly as instance variables