Bug 1319415 - pop value stack on block end before attempting to capture join register. r=bbouvier
authorLars T Hansen <lhansen@mozilla.com>
Tue, 22 Nov 2016 16:18:57 +0100
changeset 324067 f9e3af2b0e9913d87e031ec993bd25a41d82cafb
parent 324066 f4b4df249c38cf91484629eb3d59f5482f6e377c
child 324068 4f8d64aeb611657ee1b99088765e047ce16a79ad
push id84311
push userlhansen@mozilla.com
push dateThu, 24 Nov 2016 08:08:50 +0000
treeherdermozilla-inbound@f9e3af2b0e99 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbbouvier
bugs1319415
milestone53.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1319415 - pop value stack on block end before attempting to capture join register. r=bbouvier
js/src/jit-test/tests/wasm/regress/baseline-pop-before-capture.js
js/src/wasm/WasmBaselineCompile.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/baseline-pop-before-capture.js
@@ -0,0 +1,14 @@
+// Bug 1319415
+
+load(libdir + "wasm.js");
+
+var src =
+`(module
+  (func (result i32)
+    i32.const 0
+    i32.const 1
+    br_if 0
+    unreachable)
+  (export "run" 0))`;
+
+wasmFullPass(src, 0);
--- a/js/src/wasm/WasmBaselineCompile.cpp
+++ b/js/src/wasm/WasmBaselineCompile.cpp
@@ -4865,28 +4865,28 @@ BaseCompiler::endBlock(ExprType type)
 
     // Save the value.
     AnyReg r;
     if (!deadCode_)
         r = popJoinRegUnlessVoid(type);
 
     // Leave the block.
     popStackOnBlockExit(block.framePushed);
+    popValueStackTo(block.stackSize);
 
     // Bind after cleanup: branches out will have popped the stack.
     if (block.label->used()) {
         masm.bind(block.label);
         // No value was provided by the fallthrough but the branch out will
         // have stored one in joinReg, so capture that.
         if (deadCode_)
             r = captureJoinRegUnlessVoid(type);
         deadCode_ = false;
     }
 
-    popValueStackTo(block.stackSize);
     popControl();
 
     // Retain the value stored in joinReg by all paths, if there are any.
     if (!deadCode_)
         pushJoinRegUnlessVoid(r);
 }
 
 bool
@@ -4918,18 +4918,18 @@ BaseCompiler::endLoop(ExprType type)
 {
     Control& block = controlItem(0);
 
     AnyReg r;
     if (!deadCode_)
         r = popJoinRegUnlessVoid(type);
 
     popStackOnBlockExit(block.framePushed);
-
     popValueStackTo(block.stackSize);
+
     popControl();
 
     // Retain the value stored in joinReg by all paths.
     if (!deadCode_)
         pushJoinRegUnlessVoid(r);
 }
 
 // The bodies of the "then" and "else" arms can be arbitrary sequences
@@ -4979,26 +4979,26 @@ BaseCompiler::emitIf()
 }
 
 void
 BaseCompiler::endIfThen()
 {
     Control& ifThen = controlItem(0);
 
     popStackOnBlockExit(ifThen.framePushed);
+    popValueStackTo(ifThen.stackSize);
 
     if (ifThen.otherLabel->used())
         masm.bind(ifThen.otherLabel);
 
     if (ifThen.label->used())
         masm.bind(ifThen.label);
 
     deadCode_ = ifThen.deadOnArrival;
 
-    popValueStackTo(ifThen.stackSize);
     popControl();
 }
 
 bool
 BaseCompiler::emitElse()
 {
     ExprType thenType;
     Nothing unused_thenValue;
@@ -5013,27 +5013,26 @@ BaseCompiler::emitElse()
 
     ifThenElse.deadThenBranch = deadCode_;
 
     AnyReg r;
     if (!deadCode_)
         r = popJoinRegUnlessVoid(thenType);
 
     popStackOnBlockExit(ifThenElse.framePushed);
+    popValueStackTo(ifThenElse.stackSize);
 
     if (!deadCode_)
         masm.jump(ifThenElse.label);
 
     if (ifThenElse.otherLabel->used())
         masm.bind(ifThenElse.otherLabel);
 
     // Reset to the "else" branch.
 
-    popValueStackTo(ifThenElse.stackSize);
-
     if (!deadCode_)
         freeJoinRegUnlessVoid(r);
 
     deadCode_ = ifThenElse.deadOnArrival;
 
     return true;
 }
 
@@ -5049,32 +5048,32 @@ BaseCompiler::endIfThenElse(ExprType typ
     // we want to find there.  The "then" arm has the same constraint.
 
     AnyReg r;
 
     if (!deadCode_)
         r = popJoinRegUnlessVoid(type);
 
     popStackOnBlockExit(ifThenElse.framePushed);
+    popValueStackTo(ifThenElse.stackSize);
 
     if (ifThenElse.label->used())
         masm.bind(ifThenElse.label);
 
     bool joinLive = !ifThenElse.deadOnArrival &&
                     (!ifThenElse.deadThenBranch || !deadCode_ || ifThenElse.label->bound());
 
     if (joinLive) {
         // No value was provided by the "then" path but capture the one
         // provided by the "else" path.
         if (deadCode_)
             r = captureJoinRegUnlessVoid(type);
         deadCode_ = false;
     }
 
-    popValueStackTo(ifThenElse.stackSize);
     popControl();
 
     if (!deadCode_)
         pushJoinRegUnlessVoid(r);
 }
 
 bool
 BaseCompiler::emitEnd()