Bug 1534492 - Prevent RegAlloc from allocating an argument register for a temp used in passAbiArg base operand. r=sstangl
authorNicolas B. Pierron <nicolas.b.pierron@nbp.name>
Thu, 04 Apr 2019 13:33:34 +0000
changeset 529874 b23278bf5294b13d8228fb93515c4ee973ec5b7f
parent 529873 5851c65af0e0567d9cea916dd1d303f3b6ebe83b
child 529875 fa32258ea57aff354b8e5f552b7453136e513b95
push id2082
push userffxbld-merge
push dateMon, 01 Jul 2019 08:34:18 +0000
treeherdermozilla-release@2fb19d0466d2 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssstangl
bugs1534492
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1534492 - Prevent RegAlloc from allocating an argument register for a temp used in passAbiArg base operand. r=sstangl Differential Revision: https://phabricator.services.mozilla.com/D25944
js/src/jit-test/tests/ion/sincos-abi-args-bug1534492.js
js/src/jit/Lowering.cpp
js/src/jit/none/MacroAssembler-none.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/sincos-abi-args-bug1534492.js
@@ -0,0 +1,6 @@
+x = [0];
+for (let i = 0; i < 1; ++i) {
+    try {
+        Math.cos(x[0])(Math.sin(x[0]));
+    } catch (e) {}
+}
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3404,17 +3404,18 @@ void LIRGenerator::visitArrayJoin(MArray
 
 void LIRGenerator::visitSinCos(MSinCos* ins) {
   MOZ_ASSERT(ins->type() == MIRType::SinCosDouble);
   MOZ_ASSERT(ins->input()->type() == MIRType::Double ||
              ins->input()->type() == MIRType::Float32 ||
              ins->input()->type() == MIRType::Int32);
 
   LSinCos* lir = new (alloc()) LSinCos(useRegisterAtStart(ins->input()),
-                                       tempFixed(CallTempReg0), temp());
+                                       tempFixed(CallTempNonArgRegs[0]),
+                                       tempFixed(CallTempNonArgRegs[1]));
   defineSinCos(lir, ins);
 }
 
 void LIRGenerator::visitStringSplit(MStringSplit* ins) {
   MOZ_ASSERT(ins->type() == MIRType::Object);
   MOZ_ASSERT(ins->string()->type() == MIRType::String);
   MOZ_ASSERT(ins->separator()->type() == MIRType::String);
 
--- a/js/src/jit/none/MacroAssembler-none.h
+++ b/js/src/jit/none/MacroAssembler-none.h
@@ -39,16 +39,19 @@ static constexpr Register OsrFrameReg{Re
 static constexpr Register PreBarrierReg{Registers::invalid_reg};
 static constexpr Register CallTempReg0{Registers::invalid_reg};
 static constexpr Register CallTempReg1{Registers::invalid_reg};
 static constexpr Register CallTempReg2{Registers::invalid_reg};
 static constexpr Register CallTempReg3{Registers::invalid_reg};
 static constexpr Register CallTempReg4{Registers::invalid_reg};
 static constexpr Register CallTempReg5{Registers::invalid_reg};
 static constexpr Register InvalidReg{Registers::invalid_reg};
+  static constexpr Register CallTempNonArgRegs[] = {InvalidReg, InvalidReg};
+  static const uint32_t NumCallTempNonArgRegs =
+    mozilla::ArrayLength(CallTempNonArgRegs);
 
 static constexpr Register IntArgReg0{Registers::invalid_reg};
 static constexpr Register IntArgReg1{Registers::invalid_reg};
 static constexpr Register IntArgReg2{Registers::invalid_reg};
 static constexpr Register IntArgReg3{Registers::invalid_reg};
 static constexpr Register HeapReg{Registers::invalid_reg};
 
 static constexpr Register RegExpTesterRegExpReg{Registers::invalid_reg};