Backed out changeset d94b6a6469b4 (bug 1092947) for jsreftest crashes.

js/src/jit/CodeGenerator.cpp

@@ -2097,12 +2097,10 @@ CodeGenerator::visitOsrEntry(LOsrEntry *lir)
     }
 #endif
 
-    // Allocate the full frame for this function
-    // Note we have a new entry here. So we reset MacroAssembler::framePushed()
-    // to 0, before reserving the stack.
-    MOZ_ASSERT(masm.framePushed() == frameSize());
-    masm.setFramePushed(0);
-    masm.reserveStack(frameSize());
+    // Allocate the full frame for this function.
+    uint32_t size = frameSize();
+    if (size != 0)
+        masm.subPtr(Imm32(size), StackPointer);
     return true;
 }
 
@@ -3595,6 +3593,23 @@ CodeGenerator::generateArgumentsChecks(bool bailout)
     MIRGraph &mir = gen->graph();
     MResumePoint *rp = mir.entryResumePoint();
 
+    // Reserve the amount of stack the actual frame will use. We have to undo
+    // this before falling through to the method proper though, because the
+    // monomorphic call case will bypass this entire path.
+
+    // On windows, we cannot skip very far down the stack without touching the
+    // memory pages in-between.  This is a corner-case code for situations where the
+    // Ion frame data for a piece of code is very large.  To handle this special case,
+    // for frames over 1k in size we allocate memory on the stack incrementally, touching
+    // it as we go.
+    uint32_t frameSizeLeft = frameSize();
+    while (frameSizeLeft > 4096) {
+        masm.reserveStack(4096);
+        masm.store32(Imm32(0), Address(StackPointer, 0));
+        frameSizeLeft -= 4096;
+    }
+    masm.reserveStack(frameSizeLeft);
+
     // No registers are allocated yet, so it's safe to grab anything.
     Register temp = GeneralRegisterSet(EntryTempMask).getAny();
 
@@ -3629,6 +3644,8 @@ CodeGenerator::generateArgumentsChecks(bool bailout)
         }
     }
 
+    masm.freeStack(frameSize());
+
     return true;
 }
 
@@ -7424,8 +7441,14 @@ CodeGenerator::generate()
     if (!safepoints_.init(gen->alloc(), graph.totalSlotCount()))
         return false;
 
-    if (!generatePrologue())
-        return false;
+#ifdef JS_TRACE_LOGGING
+    if (!gen->compilingAsmJS() && gen->info().executionMode() == SequentialExecution) {
+        if (!emitTracelogScriptStart())
+            return false;
+        if (!emitTracelogStartEvent(TraceLogger::IonMonkey))
+            return false;
+    }
+#endif
 
     // Before generating any code, we generate type checks for all parameters.
     // This comes before deoptTable_, because we can't use deopt tables without
@@ -7439,19 +7462,14 @@ CodeGenerator::generate()
             return false;
     }
 
-    // Skip over the alternative entry to IonScript code.
-    Label skipPrologue;
-    masm.jump(&skipPrologue);
+#ifdef JS_TRACE_LOGGING
+    Label skip;
+    masm.jump(&skip);
+#endif
 
-    // An alternative entry to the IonScript code, which doesn't test the
-    // arguments.
+    // Remember the entry offset to skip the argument check.
     masm.flushBuffer();
     setSkipArgCheckEntryOffset(masm.size());
-    masm.setFramePushed(0);
-    if (!generatePrologue())
-        return false;
-
-    masm.bind(&skipPrologue);
 
 #ifdef JS_TRACE_LOGGING
     if (!gen->compilingAsmJS() && gen->info().executionMode() == SequentialExecution) {
@@ -7460,6 +7478,7 @@ CodeGenerator::generate()
         if (!emitTracelogStartEvent(TraceLogger::IonMonkey))
             return false;
     }
+    masm.bind(&skip);
 #endif
 
 #ifdef DEBUG
@@ -7468,6 +7487,9 @@ CodeGenerator::generate()
         return false;
 #endif
 
+    if (!generatePrologue())
+        return false;
+
     // Reset native => bytecode map table with top-level script and startPc.
     if (!addNativeToBytecodeEntry(startSite))
         return false;

js/src/jit/arm/CodeGenerator-arm.cpp

@@ -40,7 +40,6 @@ CodeGeneratorARM::CodeGeneratorARM(MIRGenerator *gen, LIRGraph *graph, MacroAsse
 bool
 CodeGeneratorARM::generatePrologue()
 {
-    MOZ_ASSERT(masm.framePushed() == 0);
     MOZ_ASSERT(!gen->compilingAsmJS());
 
     // Note that this automatically sets MacroAssembler::framePushed().

js/src/jit/mips/CodeGenerator-mips.cpp

@@ -40,9 +40,7 @@ CodeGeneratorMIPS::CodeGeneratorMIPS(MIRGenerator *gen, LIRGraph *graph, MacroAs
 bool
 CodeGeneratorMIPS::generatePrologue()
 {
-    MOZ_ASSERT(masm.framePushed() == 0);
     MOZ_ASSERT(!gen->compilingAsmJS());
-
     // Note that this automatically sets MacroAssembler::framePushed().
     masm.reserveStack(frameSize());
     masm.checkStackAlignment();

js/src/jit/shared/CodeGenerator-x86-shared.cpp

@@ -41,11 +41,11 @@ CodeGeneratorX86Shared::CodeGeneratorX86Shared(MIRGenerator *gen, LIRGraph *grap
 bool
 CodeGeneratorX86Shared::generatePrologue()
 {
-    MOZ_ASSERT(masm.framePushed() == 0);
     MOZ_ASSERT(!gen->compilingAsmJS());
 
     // Note that this automatically sets MacroAssembler::framePushed().
     masm.reserveStack(frameSize());
+
     return true;
 }
 

js/src/jit/x64/MacroAssembler-x64.h

@@ -552,20 +552,8 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     // Common interface.
     /////////////////////////////////////////////////////////////////
     void reserveStack(uint32_t amount) {
-        if (amount) {
-            // On windows, we cannot skip very far down the stack without touching the
-            // memory pages in-between.  This is a corner-case code for situations where the
-            // Ion frame data for a piece of code is very large.  To handle this special case,
-            // for frames over 1k in size we allocate memory on the stack incrementally, touching
-            // it as we go.
-            uint32_t amountLeft = amount;
-            while (amountLeft > 4096) {
-                subq(Imm32(amount), StackPointer);
-                store32(Imm32(0), Address(StackPointer, 0));
-                amountLeft -= 4096;
-            }
-            subq(Imm32(amountLeft), StackPointer);
-        }
+        if (amount)
+            subq(Imm32(amount), StackPointer);
         framePushed_ += amount;
     }
     void freeStack(uint32_t amount) {

js/src/jit/x86/MacroAssembler-x86.h

@@ -565,20 +565,8 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     // Common interface.
     /////////////////////////////////////////////////////////////////
     void reserveStack(uint32_t amount) {
-        if (amount) {
-            // On windows, we cannot skip very far down the stack without touching the
-            // memory pages in-between.  This is a corner-case code for situations where the
-            // Ion frame data for a piece of code is very large.  To handle this special case,
-            // for frames over 1k in size we allocate memory on the stack incrementally, touching
-            // it as we go.
-            uint32_t amountLeft = amount;
-            while (amountLeft > 4096) {
-                subl(Imm32(4096), StackPointer);
-                store32(Imm32(0), Address(StackPointer, 0));
-                amountLeft -= 4096;
-            }
-            subl(Imm32(amountLeft), StackPointer);
-        }
+        if (amount)
+            subl(Imm32(amount), StackPointer);
         framePushed_ += amount;
     }
     void freeStack(uint32_t amount) {