I'm getting a crash when executing the thunk checks from code generated by virtualForThunkGenerator. I think this is a regression introduced when JIT was migrated to use the same thunks as DFG: Author: msaboff@apple.com <msaboff@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc > Date: Wed Oct 9 13:29:00 2013 +0000 Transition call and construct JITStubs to CCallHelper functions https://bugs.webkit.org/show_bug.cgi?id=122453 Reviewed by Geoffrey Garen. Transitioned cti_op_call_eval to operationCallEval. Migrated baseline JIT to use the same call thunks as the DFG. Eliminated all of the "oldStyle" thunks and related functions. ... git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157164 268f45cc-cd0 9-0410-ab3c-d52691b4dbfc The check is generated here: <snip> static MacroAssemblerCodeRef virtualForThunkGenerator( VM* vm, CodeSpecializationKind kind) { // The return address is on the stack, or in the link register. We will henc\ e // jump to the callee, or save the return address to the call frame while we // make a C++ function call to the appropriate JIT operation. CCallHelpers jit(vm); CCallHelpers::JumpList slowCase; // FIXME: we should have a story for eliminating these checks. In many cases\ , // the DFG knows that the value is definitely a cell, or definitely a functi\ on. #if USE(JSVALUE64) slowCase.append( jit.branchTest64( CCallHelpers::NonZero, GPRInfo::nonArgGPR0, GPRInfo::tagMaskRegister\ )); #else slowCase.append( jit.branch32( CCallHelpers::NotEqual, GPRInfo::nonArgGPR1, CCallHelpers::TrustedImm32(JSValue::CellTag))); #endif jit.loadPtr(CCallHelpers::Address(GPRInfo::nonArgGPR0, JSCell::structureOffs\ et()), GPRInfo::nonArgGPR2); slowCase.append( jit.branchPtr( CCallHelpers::NotEqual, CCallHelpers::Address(GPRInfo::nonArgGPR2, Structure::classInfoOffse\ t()), CCallHelpers::TrustedImmPtr(JSFunction::info()))); </snip> It is expecting the callee to be stored in nonArgGPR1 and nonArgGPR0. However, the JIT path is storing the callee is in regT1 and regT0 if you look at JIT::compileOpCall. This used to work because the check used to be generated by oldStyleLinkForGenerator which checked regT0 and regT1. -static MacroAssemblerCodeRef oldStyleVirtualForGenerator(VM* vm, FunctionPtr compile, FunctionPtr notJSFunction, const char* name, CodeSpecializationKind kind) -{ - JSInterfaceJIT jit(vm); - - JSInterfaceJIT::JumpList slowCase; - -#if USE(JSVALUE64) - slowCase.append(jit.emitJumpIfNotJSCell(JSInterfaceJIT::regT0)); -#else // USE(JSVALUE64) - slowCase.append(jit.branch32(JSInterfaceJIT::NotEqual, JSInterfaceJIT::regT1, JSInterfaceJIT::TrustedImm32(JSValue::CellTag))); -#endif // USE(JSVALUE64) - slowCase.append(jit.emitJumpIfNotType(JSInterfaceJIT::regT0, JSInterfaceJIT::regT1, JSFunctionType)); - I think the correct fix is to modify virtualForThunkGenerator to use regT0 and regT1.