Bug 258845

Summary:	Fix checkSwitchToJITForLoop on ARM64E to work with --returnEarlyFromInfiniteLoopsForFuzzing=1 --useJIT=0.
Product:	WebKit	Reporter:	Mark Lam <mark.lam>
Component:	JavaScriptCore	Assignee:	Mark Lam <mark.lam>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Mark Lam

Reported 2023-07-03 22:25:59 PDT

On ARM64E, checkSwitchToJITForLoop() assumes that we can always dispatch thru g_jscConfig.llint.gateMap[Gate::loopOSREntry], which is normally a JIT thunk. However, this entry is null when --useJIT=0. Fix this by implementing a LLInt only thunk that achieves the same thing.

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2023-07-03 22:26:31 PDT

<rdar://problem/111722535>

Mark Lam

Comment 2 2023-07-03 22:33:39 PDT

Pull request: https://github.com/WebKit/WebKit/pull/15533

EWS

Comment 3 2023-07-04 16:33:40 PDT

Committed 265760@main (d89d75b2f665): <https://commits.webkit.org/265760@main> Reviewed commits have been landed. Closing PR #15533 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.