Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (245250 => 245251)
--- trunk/Source/_javascript_Core/ChangeLog 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-05-13 21:34:43 UTC (rev 245251)
@@ -1,3 +1,33 @@
+2019-05-13 Saam Barati <[email protected]>
+
+ macro assembler code-pointer tagging has its arguments backwards
+ https://bugs.webkit.org/show_bug.cgi?id=197677
+
+ Reviewed by Michael Saboff.
+
+ We had the destination as the leftmost instead of the rightmost argument,
+ which goes against the convention of how we order arguments in macro assembler
+ methods.
+
+ * assembler/MacroAssemblerARM64E.h:
+ (JSC::MacroAssemblerARM64E::tagReturnAddress):
+ (JSC::MacroAssemblerARM64E::untagReturnAddress):
+ (JSC::MacroAssemblerARM64E::tagPtr):
+ (JSC::MacroAssemblerARM64E::untagPtr):
+ * dfg/DFGOSRExitCompilerCommon.cpp:
+ (JSC::DFG::reifyInlinedCallFrames):
+ * ftl/FTLThunks.cpp:
+ (JSC::FTL::genericGenerationThunkGenerator):
+ * jit/CCallHelpers.h:
+ (JSC::CCallHelpers::prepareForTailCallSlow):
+ * jit/CallFrameShuffler.cpp:
+ (JSC::CallFrameShuffler::prepareForTailCall):
+ * jit/ThunkGenerators.cpp:
+ (JSC::emitPointerValidation):
+ (JSC::arityFixupGenerator):
+ * wasm/js/WebAssemblyFunction.cpp:
+ (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
+
2019-05-13 Tadeu Zagallo <[email protected]>
JSObject::getOwnPropertyDescriptor is missing an exception check
Modified: trunk/Source/_javascript_Core/assembler/AbstractMacroAssembler.h (245250 => 245251)
--- trunk/Source/_javascript_Core/assembler/AbstractMacroAssembler.h 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/assembler/AbstractMacroAssembler.h 2019-05-13 21:34:43 UTC (rev 245251)
@@ -977,9 +977,9 @@
ALWAYS_INLINE void tagReturnAddress() { }
ALWAYS_INLINE void untagReturnAddress() { }
- ALWAYS_INLINE void tagPtr(RegisterID, PtrTag) { }
+ ALWAYS_INLINE void tagPtr(PtrTag, RegisterID) { }
ALWAYS_INLINE void tagPtr(RegisterID, RegisterID) { }
- ALWAYS_INLINE void untagPtr(RegisterID, PtrTag) { }
+ ALWAYS_INLINE void untagPtr(PtrTag, RegisterID) { }
ALWAYS_INLINE void untagPtr(RegisterID, RegisterID) { }
ALWAYS_INLINE void removePtrTag(RegisterID) { }
Modified: trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h (245250 => 245251)
--- trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h 2019-05-13 21:34:43 UTC (rev 245251)
@@ -41,15 +41,15 @@
public:
ALWAYS_INLINE void tagReturnAddress()
{
- tagPtr(ARM64Registers::lr, ARM64Registers::sp);
+ tagPtr(ARM64Registers::sp, ARM64Registers::lr);
}
ALWAYS_INLINE void untagReturnAddress()
{
- untagPtr(ARM64Registers::lr, ARM64Registers::sp);
+ untagPtr(ARM64Registers::sp, ARM64Registers::lr);
}
- ALWAYS_INLINE void tagPtr(RegisterID target, PtrTag tag)
+ ALWAYS_INLINE void tagPtr(PtrTag tag, RegisterID target)
{
auto tagGPR = getCachedDataTempRegisterIDAndInvalidate();
move(TrustedImm64(tag), tagGPR);
@@ -56,7 +56,7 @@
m_assembler.pacib(target, tagGPR);
}
- ALWAYS_INLINE void tagPtr(RegisterID target, RegisterID tag)
+ ALWAYS_INLINE void tagPtr(RegisterID tag, RegisterID target)
{
if (target == ARM64Registers::lr && tag == ARM64Registers::sp) {
m_assembler.pacibsp();
@@ -65,7 +65,7 @@
m_assembler.pacib(target, tag);
}
- ALWAYS_INLINE void untagPtr(RegisterID target, PtrTag tag)
+ ALWAYS_INLINE void untagPtr(PtrTag tag, RegisterID target)
{
auto tagGPR = getCachedDataTempRegisterIDAndInvalidate();
move(TrustedImm64(tag), tagGPR);
@@ -72,7 +72,7 @@
m_assembler.autib(target, tagGPR);
}
- ALWAYS_INLINE void untagPtr(RegisterID target, RegisterID tag)
+ ALWAYS_INLINE void untagPtr(RegisterID tag, RegisterID target)
{
m_assembler.autib(target, tag);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGOSRExitCompilerCommon.cpp (245250 => 245251)
--- trunk/Source/_javascript_Core/dfg/DFGOSRExitCompilerCommon.cpp 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/dfg/DFGOSRExitCompilerCommon.cpp 2019-05-13 21:34:43 UTC (rev 245251)
@@ -157,9 +157,9 @@
jit.loadPtr(AssemblyHelpers::Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()), GPRInfo::regT3);
#if CPU(ARM64E)
jit.addPtr(AssemblyHelpers::TrustedImm32(sizeof(CallerFrameAndPC)), GPRInfo::callFrameRegister, GPRInfo::regT2);
- jit.untagPtr(GPRInfo::regT3, GPRInfo::regT2);
+ jit.untagPtr(GPRInfo::regT2, GPRInfo::regT3);
jit.addPtr(AssemblyHelpers::TrustedImm32(inlineCallFrame->returnPCOffset() + sizeof(void*)), GPRInfo::callFrameRegister, GPRInfo::regT2);
- jit.tagPtr(GPRInfo::regT3, GPRInfo::regT2);
+ jit.tagPtr(GPRInfo::regT2, GPRInfo::regT3);
#endif
jit.storePtr(GPRInfo::regT3, AssemblyHelpers::addressForByteOffset(inlineCallFrame->returnPCOffset()));
jit.loadPtr(AssemblyHelpers::Address(GPRInfo::callFrameRegister, CallFrame::callerFrameOffset()), GPRInfo::regT3);
@@ -209,7 +209,7 @@
#if CPU(ARM64E)
jit.addPtr(AssemblyHelpers::TrustedImm32(inlineCallFrame->returnPCOffset() + sizeof(void*)), GPRInfo::callFrameRegister, GPRInfo::regT2);
jit.move(AssemblyHelpers::TrustedImmPtr(jumpTarget), GPRInfo::nonArgGPR0);
- jit.tagPtr(GPRInfo::nonArgGPR0, GPRInfo::regT2);
+ jit.tagPtr(GPRInfo::regT2, GPRInfo::nonArgGPR0);
jit.storePtr(GPRInfo::nonArgGPR0, AssemblyHelpers::addressForByteOffset(inlineCallFrame->returnPCOffset()));
#else
jit.storePtr(AssemblyHelpers::TrustedImmPtr(jumpTarget), AssemblyHelpers::addressForByteOffset(inlineCallFrame->returnPCOffset()));
Modified: trunk/Source/_javascript_Core/ftl/FTLThunks.cpp (245250 => 245251)
--- trunk/Source/_javascript_Core/ftl/FTLThunks.cpp 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/ftl/FTLThunks.cpp 2019-05-13 21:34:43 UTC (rev 245251)
@@ -116,7 +116,7 @@
restoreAllRegisters(jit, buffer);
#if CPU(ARM64E)
- jit.untagPtr(AssemblyHelpers::linkRegister, resultTag);
+ jit.untagPtr(resultTag, AssemblyHelpers::linkRegister);
jit.tagReturnAddress();
#else
UNUSED_PARAM(resultTag);
Modified: trunk/Source/_javascript_Core/jit/CCallHelpers.h (245250 => 245251)
--- trunk/Source/_javascript_Core/jit/CCallHelpers.h 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/jit/CCallHelpers.h 2019-05-13 21:34:43 UTC (rev 245251)
@@ -807,7 +807,7 @@
subPtr(TrustedImm32(2 * sizeof(void*)), newFrameSizeGPR);
#if CPU(ARM64E)
addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), MacroAssembler::framePointerRegister, tempGPR);
- untagPtr(linkRegister, tempGPR);
+ untagPtr(tempGPR, linkRegister);
#endif
#elif CPU(MIPS)
loadPtr(Address(framePointerRegister, sizeof(void*)), returnAddressRegister);
Modified: trunk/Source/_javascript_Core/jit/CallFrameShuffler.cpp (245250 => 245251)
--- trunk/Source/_javascript_Core/jit/CallFrameShuffler.cpp 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/jit/CallFrameShuffler.cpp 2019-05-13 21:34:43 UTC (rev 245251)
@@ -456,7 +456,7 @@
MacroAssembler::linkRegister);
#if CPU(ARM64E)
m_jit.addPtr(MacroAssembler::TrustedImm32(sizeof(CallerFrameAndPC)), MacroAssembler::framePointerRegister);
- m_jit.untagPtr(MacroAssembler::linkRegister, MacroAssembler::framePointerRegister);
+ m_jit.untagPtr(MacroAssembler::framePointerRegister, MacroAssembler::linkRegister);
m_jit.subPtr(MacroAssembler::TrustedImm32(sizeof(CallerFrameAndPC)), MacroAssembler::framePointerRegister);
#endif
Modified: trunk/Source/_javascript_Core/jit/ThunkGenerators.cpp (245250 => 245251)
--- trunk/Source/_javascript_Core/jit/ThunkGenerators.cpp 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/jit/ThunkGenerators.cpp 2019-05-13 21:34:43 UTC (rev 245251)
@@ -53,7 +53,7 @@
jit.abortWithReason(TGInvalidPointer);
isNonZero.link(&jit);
jit.pushToSave(pointerGPR);
- jit.untagPtr(pointerGPR, tag);
+ jit.untagPtr(tag, pointerGPR);
jit.load8(pointerGPR, pointerGPR);
jit.popToRestore(pointerGPR);
}
@@ -459,10 +459,10 @@
#if CPU(ARM64E)
jit.loadPtr(JSInterfaceJIT::Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()), GPRInfo::regT3);
jit.addPtr(JSInterfaceJIT::TrustedImm32(sizeof(CallerFrameAndPC)), GPRInfo::callFrameRegister, extraTemp);
- jit.untagPtr(GPRInfo::regT3, extraTemp);
+ jit.untagPtr(extraTemp, GPRInfo::regT3);
PtrTag tempReturnPCTag = static_cast<PtrTag>(random());
jit.move(JSInterfaceJIT::TrustedImmPtr(tempReturnPCTag), extraTemp);
- jit.tagPtr(GPRInfo::regT3, extraTemp);
+ jit.tagPtr(extraTemp, GPRInfo::regT3);
jit.storePtr(GPRInfo::regT3, JSInterfaceJIT::Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()));
#endif
jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
@@ -515,9 +515,9 @@
#if CPU(ARM64E)
jit.loadPtr(JSInterfaceJIT::Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()), GPRInfo::regT3);
jit.move(JSInterfaceJIT::TrustedImmPtr(tempReturnPCTag), extraTemp);
- jit.untagPtr(GPRInfo::regT3, extraTemp);
+ jit.untagPtr(extraTemp, GPRInfo::regT3);
jit.addPtr(JSInterfaceJIT::TrustedImm32(sizeof(CallerFrameAndPC)), GPRInfo::callFrameRegister, extraTemp);
- jit.tagPtr(GPRInfo::regT3, extraTemp);
+ jit.tagPtr(extraTemp, GPRInfo::regT3);
jit.storePtr(GPRInfo::regT3, JSInterfaceJIT::Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()));
#endif
Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp (245250 => 245251)
--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp 2019-05-13 21:06:56 UTC (rev 245250)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp 2019-05-13 21:34:43 UTC (rev 245251)
@@ -480,7 +480,7 @@
jit.move(CCallHelpers::TrustedImmPtr(this), GPRInfo::regT0);
jit.emitFunctionEpilogue();
#if CPU(ARM64E)
- jit.untagPtr(MacroAssembler::linkRegister, MacroAssembler::stackPointerRegister);
+ jit.untagReturnAddress();
#endif
auto jumpToHostCallThunk = jit.jump();
