FTL OSR exit should do reboxing and value recovery in the same pass
https://bugs.webkit.org/show_bug.cgi?id=136977

Reviewed by Oliver Hunt.
        
It's conceptually simpler to have all of the logic in one place. After the
recover-and-rebox loop is done, all of the exit values are in the form that the baseline
JIT would want them to be in; the only remaining task is to move them into the right
place on the stack after we do all of the necessary stack adjustments.

* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@173794 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index ebf5b98..4a978dd 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,18 @@
+2014-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL OSR exit should do reboxing and value recovery in the same pass
+        https://bugs.webkit.org/show_bug.cgi?id=136977
+
+        Reviewed by Oliver Hunt.
+        
+        It's conceptually simpler to have all of the logic in one place. After the
+        recover-and-rebox loop is done, all of the exit values are in the form that the baseline
+        JIT would want them to be in; the only remaining task is to move them into the right
+        place on the stack after we do all of the necessary stack adjustments.
+
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+
 2014-09-19  Filip Pizlo  <fpizlo@apple.com>
 
         StorageAccessData should be referenced in a sensible way
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
index 4e31a63..9147e0b 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
@@ -122,7 +122,7 @@
     }
 
     // Save all state from wherever the exit data tells us it was, into the appropriate place in
-    // the scratch buffer. This doesn't rebox any values yet.
+    // the scratch buffer. This also does the reboxing.
     
     for (unsigned index = exit.m_values.size(); index--;) {
         ExitValue value = exit.m_values[index];
@@ -197,6 +197,9 @@
             break;
         }
         
+        reboxAccordingToFormat(
+            value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
+        
         jit.store64(GPRInfo::regT0, scratch + index);
     }
     
@@ -338,15 +341,12 @@
     
     arityReturnPCReady.link(&jit);
     
-    // Now get state out of the scratch buffer and place it back into the stack. This part does
-    // all reboxing.
+    // Now get state out of the scratch buffer and place it back into the stack. The values are
+    // already reboxed so we just move them.
     for (unsigned index = exit.m_values.size(); index--;) {
         int operand = exit.m_values.operandForIndex(index);
-        ExitValue value = exit.m_values[index];
         
         jit.load64(scratch + index, GPRInfo::regT0);
-        reboxAccordingToFormat(
-            value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
         jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(static_cast<VirtualRegister>(operand)));
     }