Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (246239 => 246240)
--- trunk/Source/_javascript_Core/ChangeLog 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-06-09 20:28:18 UTC (rev 246240)
@@ -1,3 +1,24 @@
+2019-06-09 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r246150, r246160, and r246166.
+ https://bugs.webkit.org/show_bug.cgi?id=198698
+
+ Regresses page loading time on iOS 13 (Requested by keith_m__
+ on #webkit).
+
+ Reverted changesets:
+
+ "Reenable Gigacage on ARM64."
+ https://bugs.webkit.org/show_bug.cgi?id=198453
+ https://trac.webkit.org/changeset/246150
+
+ "Unrevied build fix for FTL without Gigacage."
+ https://trac.webkit.org/changeset/246160
+
+ "Fix typo in cageWithoutUntagging"
+ https://bugs.webkit.org/show_bug.cgi?id=198617
+ https://trac.webkit.org/changeset/246166
+
2019-06-09 Yusuke Suzuki <[email protected]>
[JSC] Use mergePrediction in ValuePow prediction propagation
Modified: trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64.h (246239 => 246240)
--- trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64.h 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64.h 2019-06-09 20:28:18 UTC (rev 246240)
@@ -2526,15 +2526,6 @@
m_assembler.fcsel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
}
- // Bit field operations:
-
- // destBitOffset is the top bit of the destination where the bits should be copied to. Zero is the lowest order bit.
- void bitFieldInsert64(RegisterID source, unsigned destBitOffset, unsigned width, RegisterID dest)
- {
- ASSERT(width <= 64 - destBitOffset && destBitOffset < 64);
- m_assembler.bfi<64>(dest, source, destBitOffset, width);
- }
-
// Forwards / external control flow operations:
//
// This set of jump and conditional branch operations return a Jump
Modified: trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h (246239 => 246240)
--- trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h 2019-06-09 20:28:18 UTC (rev 246240)
@@ -39,8 +39,6 @@
class MacroAssemblerARM64E : public MacroAssemblerARM64 {
public:
- static constexpr unsigned numberOfPACBits = 25;
-
ALWAYS_INLINE void tagReturnAddress()
{
tagPtr(ARM64Registers::sp, ARM64Registers::lr);
Modified: trunk/Source/_javascript_Core/assembler/testmasm.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/assembler/testmasm.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/assembler/testmasm.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -39,7 +39,6 @@
#include <wtf/Function.h>
#include <wtf/Lock.h>
#include <wtf/NumberOfCores.h>
-#include <wtf/PtrTag.h>
#include <wtf/Threading.h>
#include <wtf/text/StringCommon.h>
@@ -110,15 +109,6 @@
CRASH(); \
} while (false)
-#define CHECK_NOT_EQ(_actual, _expected) do { \
- if ((_actual) != (_expected)) \
- break; \
- crashLock.lock(); \
- dataLog("FAILED while testing " #_actual ": expected not: ", _expected, ", actual: ", _actual, "\n"); \
- WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, "CHECK_NOT_EQ("#_actual ", " #_expected ")"); \
- CRASH(); \
- } while (false)
-
#if ENABLE(MASM_PROBE)
bool isPC(MacroAssembler::RegisterID id)
{
@@ -1013,47 +1003,6 @@
#endif
}
-static void testCagePreservesPACFailureBit()
-{
- auto cage = compile([] (CCallHelpers& jit) {
- jit.emitFunctionPrologue();
- jit.cageConditionally(Gigacage::Primitive, GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::argumentGPR2);
- jit.move(GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
- jit.emitFunctionEpilogue();
- jit.ret();
- });
-
- void* ptr = Gigacage::tryMalloc(Gigacage::Primitive, 1);
- void* taggedPtr = tagArrayPtr(ptr, 1);
- dataLogLn("starting test");
- if (isARM64E()) {
- // FIXME: This won't work if authentication failures trap but I don't know how to test for that right now.
- CHECK_NOT_EQ(invoke<void*>(cage, taggedPtr, 2), ptr);
- } else
- CHECK_EQ(invoke<void*>(cage, taggedPtr, 2), ptr);
-
- CHECK_EQ(invoke<void*>(cage, taggedPtr, 1), ptr);
-
- auto cageWithoutAuthentication = compile([] (CCallHelpers& jit) {
- jit.emitFunctionPrologue();
- jit.cageWithoutUntagging(Gigacage::Primitive, GPRInfo::argumentGPR0);
- jit.move(GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
- jit.emitFunctionEpilogue();
- jit.ret();
- });
-
- if (isARM64E()) {
- // FIXME: This won't work if authentication failures trap but I don't know how to test for that right now.
- CHECK_NOT_EQ(invoke<void*>(cageWithoutAuthentication, untagArrayPtr(taggedPtr, 2)), ptr);
- } else
- CHECK_EQ(invoke<void*>(cageWithoutAuthentication, untagArrayPtr(taggedPtr, 2)), ptr);
-
- CHECK_EQ(untagArrayPtr(taggedPtr, 1), ptr);
- CHECK_EQ(invoke<void*>(cageWithoutAuthentication, untagArrayPtr(taggedPtr, 1)), ptr);
-
- Gigacage::free(Gigacage::Primitive, ptr);
-}
-
#define RUN(test) do { \
if (!shouldRun(#test)) \
break; \
@@ -1139,8 +1088,6 @@
RUN(testMoveDoubleConditionally32());
RUN(testMoveDoubleConditionally64());
- RUN(testCagePreservesPACFailureBit());
-
if (tasks.isEmpty())
usage();
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -2873,7 +2873,7 @@
TrustedImm32(WastefulTypedArray));
JITCompiler::Jump hasNullVector;
-#if CPU(ARM64E)
+#if !GIGACAGE_ENABLED && CPU(ARM64E)
{
GPRReg scratch = m_jit.scratchRegister();
DisallowMacroScratchRegisterUsage disallowScratch(m_jit);
@@ -2882,7 +2882,7 @@
m_jit.removeArrayPtrTag(scratch);
hasNullVector = m_jit.branchTestPtr(MacroAssembler::Zero, scratch);
}
-#else // CPU(ARM64E)
+#else // !GIGACAGE_ENABLED && CPU(ARM64E)
hasNullVector = m_jit.branchTestPtr(
MacroAssembler::Zero,
MacroAssembler::Address(base, JSArrayBufferView::offsetOfVector()));
@@ -6760,13 +6760,6 @@
void SpeculativeJIT::cageTypedArrayStorage(GPRReg baseReg, GPRReg storageReg)
{
-#if CPU(ARM64E)
- m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
-#else
- UNUSED_PARAM(baseReg);
- UNUSED_PARAM(storageReg);
-#endif
-
#if GIGACAGE_ENABLED
UNUSED_PARAM(baseReg);
if (!Gigacage::shouldBeEnabled())
@@ -6779,7 +6772,12 @@
return;
}
- m_jit.cageWithoutUntagging(Gigacage::Primitive, storageReg);
+ m_jit.cage(Gigacage::Primitive, storageReg);
+#elif CPU(ARM64E)
+ m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
+#else
+ UNUSED_PARAM(baseReg);
+ UNUSED_PARAM(storageReg);
#endif
}
@@ -6843,7 +6841,7 @@
JITCompiler::Jump nullVector = m_jit.branchTestPtr(JITCompiler::Zero, vectorGPR);
m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), dataGPR);
- m_jit.cageWithoutUntagging(Gigacage::JSValue, dataGPR);
+ m_jit.cage(Gigacage::JSValue, dataGPR);
cageTypedArrayStorage(baseGPR, vectorGPR);
@@ -9847,7 +9845,7 @@
MacroAssembler::BaseIndex(storageGPR, scratchGPR, MacroAssembler::TimesFour));
m_jit.branchTest32(MacroAssembler::NonZero, scratchGPR).linkTo(loop, &m_jit);
done.link(&m_jit);
-#if CPU(ARM64E)
+#if !GIGACAGE_ENABLED && CPU(ARM64E)
// sizeGPR is still boxed as a number and there is no 32-bit variant of the PAC instructions.
m_jit.zeroExtend32ToPtr(sizeGPR, scratchGPR);
m_jit.tagArrayPtr(scratchGPR, storageGPR);
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -6485,7 +6485,7 @@
m_out.int64Zero,
m_heaps.typedArrayProperties);
-#if CPU(ARM64E)
+#if !GIGACAGE_ENABLED && CPU(ARM64E)
{
LValue sizePtr = m_out.zeroExtPtr(size);
PatchpointValue* authenticate = m_out.patchpoint(pointerType());
@@ -14157,16 +14157,6 @@
LValue caged(Gigacage::Kind kind, LValue ptr, LValue base)
{
-#if CPU(ARM64E)
- if (kind == Gigacage::Primitive) {
- LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
- ptr = untagArrayPtr(ptr, size);
- }
-#else
- UNUSED_PARAM(kind);
- UNUSED_PARAM(base);
-#endif
-
#if GIGACAGE_ENABLED
UNUSED_PARAM(base);
if (!Gigacage::isEnabled(kind))
@@ -14185,18 +14175,6 @@
LValue masked = m_out.bitAnd(ptr, mask);
LValue result = m_out.add(masked, basePtr);
-#if CPU(ARM64E)
- {
- PatchpointValue* merge = m_out.patchpoint(pointerType());
- merge->append(result, B3::ValueRep(B3::ValueRep::SomeLateRegister));
- merge->appendSomeRegister(ptr);
- merge->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
- jit.move(params[2].gpr(), params[0].gpr());
- jit.bitFieldInsert64(params[1].gpr(), 0, 64 - MacroAssembler::numberOfPACBits, params[0].gpr());
- });
- result = merge;
- }
-#endif
// Make sure that B3 doesn't try to do smart reassociation of these pointer bits.
// FIXME: In an ideal world, B3 would not do harmful reassociations, and if it did, it would be able
// to undo them during constant hoisting and regalloc. As it stands, if you remove this then Octane
@@ -14209,8 +14187,18 @@
// and possibly other smart things if we want to be able to remove this opaque.
// https://bugs.webkit.org/show_bug.cgi?id=175493
return m_out.opaque(result);
+#elif CPU(ARM64E)
+ if (kind == Gigacage::Primitive) {
+ LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
+ return untagArrayPtr(ptr, size);
+ }
+
+ return ptr;
+#else
+ UNUSED_PARAM(kind);
+ UNUSED_PARAM(base);
+ return ptr;
#endif
- return ptr;
}
void buildSwitch(SwitchData* data, LType type, LValue switchValue)
Modified: trunk/Source/_javascript_Core/jit/AssemblyHelpers.h (246239 => 246240)
--- trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2019-06-09 20:28:18 UTC (rev 246240)
@@ -1554,74 +1554,43 @@
storeFence();
ok.link(this);
}
-
- void cageWithoutUntagging(Gigacage::Kind kind, GPRReg storage)
+
+ void cage(Gigacage::Kind kind, GPRReg storage)
{
#if GIGACAGE_ENABLED
if (!Gigacage::isEnabled(kind))
return;
-
-#if CPU(ARM64E)
- RegisterID tempReg = InvalidGPRReg;
- if (kind == Gigacage::Primitive) {
- tempReg = getCachedMemoryTempRegisterIDAndInvalidate();
- move(storage, tempReg);
- // Flip the registers since bitFieldInsert only inserts into the low bits.
- std::swap(storage, tempReg);
- }
-#endif
+
andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
addPtr(TrustedImmPtr(Gigacage::basePtr(kind)), storage);
-#if CPU(ARM64E)
- if (kind == Gigacage::Primitive)
- bitFieldInsert64(storage, 0, 64 - numberOfPACBits, tempReg);
-#endif
-
#else
UNUSED_PARAM(kind);
UNUSED_PARAM(storage);
#endif
}
-
- // length may be the same register as scratch.
- void cageConditionally(Gigacage::Kind kind, GPRReg storage, GPRReg length, GPRReg scratch)
+
+ void cageConditionally(Gigacage::Kind kind, GPRReg storage, GPRReg scratchOrLength)
{
-#if CPU(ARM64E)
- if (kind == Gigacage::Primitive)
- untagArrayPtr(length, storage);
-#else
- UNUSED_PARAM(kind);
- UNUSED_PARAM(storage);
- UNUSED_PARAM(length);
-#endif
-
#if GIGACAGE_ENABLED
if (!Gigacage::isEnabled(kind))
return;
if (kind != Gigacage::Primitive || Gigacage::isDisablingPrimitiveGigacageDisabled())
- cageWithoutUntagging(kind, storage);
- else {
- loadPtr(&Gigacage::basePtr(kind), scratch);
- Jump done = branchTestPtr(Zero, scratch);
-#if CPU(ARM64E)
- auto tempReg = getCachedMemoryTempRegisterIDAndInvalidate();
- move(storage, tempReg);
- andPtr(TrustedImmPtr(Gigacage::mask(kind)), tempReg);
- addPtr(scratch, tempReg);
- bitFieldInsert64(tempReg, 0, 64 - numberOfPACBits, storage);
+ return cage(kind, storage);
+
+ loadPtr(&Gigacage::basePtr(kind), scratchOrLength);
+ Jump done = branchTestPtr(Zero, scratchOrLength);
+ andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
+ addPtr(scratchOrLength, storage);
+ done.link(this);
+#elif CPU(ARM64E)
+ if (kind == Gigacage::Primitive)
+ untagArrayPtr(scratchOrLength, storage);
#else
- andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
- addPtr(scratch, storage);
+ UNUSED_PARAM(kind);
+ UNUSED_PARAM(storage);
+ UNUSED_PARAM(scratchOrLength);
#endif
- done.link(this);
-
-
- }
-#else
- UNUSED_PARAM(scratch);
-#endif
-
}
void emitComputeButterflyIndexingMask(GPRReg vectorLengthGPR, GPRReg scratchGPR, GPRReg resultGPR)
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -1672,7 +1672,7 @@
load32(Address(base, JSArrayBufferView::offsetOfLength()), scratch2);
slowCases.append(branch32(AboveOrEqual, property, scratch2));
loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
- cageConditionally(Gigacage::Primitive, scratch, scratch2, scratch2);
+ cageConditionally(Gigacage::Primitive, scratch, scratch2);
switch (elementSize(type)) {
case 1:
@@ -1736,7 +1736,7 @@
load32(Address(base, JSArrayBufferView::offsetOfLength()), scratch2);
slowCases.append(branch32(AboveOrEqual, property, scratch2));
loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
- cageConditionally(Gigacage::Primitive, scratch, scratch2, scratch2);
+ cageConditionally(Gigacage::Primitive, scratch, scratch2);
switch (elementSize(type)) {
case 4:
@@ -1801,7 +1801,7 @@
// We would be loading this into base as in get_by_val, except that the slow
// path expects the base to be unclobbered.
loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
- cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2, lateScratch2);
+ cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2);
if (isClamped(type)) {
ASSERT(elementSize(type) == 1);
@@ -1890,7 +1890,7 @@
// We would be loading this into base as in get_by_val, except that the slow
// path expects the base to be unclobbered.
loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
- cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2, lateScratch2);
+ cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2);
switch (elementSize(type)) {
case 4:
Modified: trunk/Source/_javascript_Core/llint/LowLevelInterpreter.asm (246239 => 246240)
--- trunk/Source/_javascript_Core/llint/LowLevelInterpreter.asm 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/llint/LowLevelInterpreter.asm 2019-06-09 20:28:18 UTC (rev 246240)
@@ -76,7 +76,7 @@
#
# - pc holds the (native) program counter on 32-bits ARM architectures (ARMv7)
#
-# - t0, t1, t2, t3, t4, and optionally t5, t6, and t7 are temporary registers that can get trashed on
+# - t0, t1, t2, t3, t4 and optionally t5 are temporary registers that can get trashed on
# calls, and are pairwise distinct registers. t4 holds the JS program counter, so use
# with caution in opcodes (actually, don't use it in opcodes at all, except as PC).
#
Modified: trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm (246239 => 246240)
--- trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm 2019-06-09 20:28:18 UTC (rev 246240)
@@ -434,20 +434,11 @@
macro loadCagedPrimitive(source, dest, scratchOrLength)
loadp source, dest
- if ARM64E
- const result = t7
+ if GIGACAGE_ENABLED
+ uncage(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr Gigacage::primitiveGigacageMask, dest, scratchOrLength)
+ elsif ARM64E
untagArrayPtr scratchOrLength, dest
- move dest, result
- else
- const result = dest
end
- if GIGACAGE_ENABLED
- uncage(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr Gigacage::primitiveGigacageMask, result, scratchOrLength)
- if ARM64E
- const numberOfPACBits = constexpr MacroAssembler::numberOfPACBits
- bfiq result, 0, 64 - numberOfPACBits, dest
- end
- end
end
macro loadCagedJSValue(source, dest, scratchOrLength)
Modified: trunk/Source/_javascript_Core/offlineasm/arm64.rb (246239 => 246240)
--- trunk/Source/_javascript_Core/offlineasm/arm64.rb 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/offlineasm/arm64.rb 2019-06-09 20:28:18 UTC (rev 246240)
@@ -126,8 +126,6 @@
arm64GPRName('x5', kind)
when 't6'
arm64GPRName('x6', kind)
- when 't7'
- arm64GPRName('x7', kind)
when 'cfr'
arm64GPRName('x29', kind)
when 'csr0'
@@ -1021,8 +1019,6 @@
$asm.puts "smaddl #{operands[2].arm64Operand(:quad)}, #{operands[0].arm64Operand(:word)}, #{operands[1].arm64Operand(:word)}, xzr"
when "memfence"
$asm.puts "dmb sy"
- when "bfiq"
- $asm.puts "bfi #{operands[3].arm64Operand(:quad)}, #{operands[0].arm64Operand(:quad)}, #{operands[1].value}, #{operands[2].value}"
when "pcrtoaddr"
$asm.puts "adr #{operands[1].arm64Operand(:quad)}, #{operands[0].value}"
when "nopCortexA53Fix835769"
Modified: trunk/Source/_javascript_Core/offlineasm/instructions.rb (246239 => 246240)
--- trunk/Source/_javascript_Core/offlineasm/instructions.rb 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/offlineasm/instructions.rb 2019-06-09 20:28:18 UTC (rev 246240)
@@ -273,7 +273,6 @@
ARM64_INSTRUCTIONS =
[
- "bfiq", # Bit field insert <source reg> <last bit written> <width immediate> <dest reg>
"pcrtoaddr", # Address from PC relative offset - adr instruction
"nopFixCortexA53Err835769", # nop on Cortex-A53 (nothing otherwise)
"globaladdr"
Modified: trunk/Source/_javascript_Core/offlineasm/registers.rb (246239 => 246240)
--- trunk/Source/_javascript_Core/offlineasm/registers.rb 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/offlineasm/registers.rb 2019-06-09 20:28:18 UTC (rev 246240)
@@ -32,7 +32,6 @@
"t4",
"t5",
"t6",
- "t7",
"cfr",
"a0",
"a1",
Modified: trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -848,7 +848,8 @@
patchpoint->numGPScratchRegisters = Gigacage::isEnabled(Gigacage::Primitive) ? 1 : 0;
patchpoint->setGenerator([pinnedRegs] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
- AllowMacroScratchRegisterUsage allowScratch(jit);
+ RELEASE_ASSERT(!Gigacage::isEnabled(Gigacage::Primitive) || !isARM64());
+ AllowMacroScratchRegisterUsageIf allowScratch(jit, !isARM64());
GPRReg baseMemory = pinnedRegs->baseMemoryPointer;
GPRReg scratchOrSize = Gigacage::isEnabled(Gigacage::Primitive) ? params.gpScratch(0) : pinnedRegs->sizeRegister;
@@ -855,7 +856,7 @@
jit.loadPtr(CCallHelpers::Address(params[0].gpr(), Instance::offsetOfCachedMemorySize()), pinnedRegs->sizeRegister);
jit.loadPtr(CCallHelpers::Address(params[0].gpr(), Instance::offsetOfCachedMemory()), baseMemory);
- jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs->sizeRegister, scratchOrSize);
+ jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
});
emitPatchpoint(block, patchpoint, Tmp(), instance);
@@ -1987,7 +1988,7 @@
jit.loadPtr(CCallHelpers::Address(newContextInstance, Instance::offsetOfCachedMemorySize()), pinnedRegs.sizeRegister); // Memory size.
jit.loadPtr(CCallHelpers::Address(newContextInstance, Instance::offsetOfCachedMemory()), baseMemory); // Memory::void*.
- jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs.sizeRegister, scratchOrSize);
+ jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
});
emitPatchpoint(doContextSwitch, patchpoint, Tmp(), newContextInstance, instanceValue());
Modified: trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -491,7 +491,8 @@
patchpoint->append(instance, ValueRep::SomeRegister);
patchpoint->setGenerator([pinnedRegs] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
- AllowMacroScratchRegisterUsage allowScratch(jit);
+ RELEASE_ASSERT(!Gigacage::isEnabled(Gigacage::Primitive) || !isARM64());
+ AllowMacroScratchRegisterUsageIf allowScratch(jit, !isARM64());
GPRReg baseMemory = pinnedRegs->baseMemoryPointer;
GPRReg scratchOrSize = Gigacage::isEnabled(Gigacage::Primitive) ? params.gpScratch(0) : pinnedRegs->sizeRegister;
@@ -498,7 +499,7 @@
jit.loadPtr(CCallHelpers::Address(params[0].gpr(), Instance::offsetOfCachedMemorySize()), pinnedRegs->sizeRegister);
jit.loadPtr(CCallHelpers::Address(params[0].gpr(), Instance::offsetOfCachedMemory()), baseMemory);
- jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs->sizeRegister, scratchOrSize);
+ jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
});
}
}
@@ -1400,7 +1401,7 @@
jit.loadPtr(CCallHelpers::Address(newContextInstance, Instance::offsetOfCachedMemorySize()), pinnedRegs.sizeRegister); // Memory size.
jit.loadPtr(CCallHelpers::Address(newContextInstance, Instance::offsetOfCachedMemory()), baseMemory); // Memory::void*.
- jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs.sizeRegister, scratchOrSize);
+ jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
});
doContextSwitch->appendNewControlValue(m_proc, Jump, origin(), continuation);
Modified: trunk/Source/_javascript_Core/wasm/WasmBinding.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/wasm/WasmBinding.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/wasm/WasmBinding.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -67,11 +67,11 @@
// FIXME the following code assumes that all Wasm::Instance have the same pinned registers. https://bugs.webkit.org/show_bug.cgi?id=162952
// Set up the callee's baseMemory register as well as the memory size registers.
{
- GPRReg scratchOrSize = !Gigacage::isEnabled(Gigacage::Primitive) ? pinnedRegs.sizeRegister : wasmCallingConventionAir().prologueScratch(1);
+ GPRReg scratchOrSize = isARM64E() ? pinnedRegs.sizeRegister : wasmCallingConventionAir().prologueScratch(1);
jit.loadPtr(JIT::Address(baseMemory, Wasm::Instance::offsetOfCachedMemorySize()), pinnedRegs.sizeRegister); // Memory size.
jit.loadPtr(JIT::Address(baseMemory, Wasm::Instance::offsetOfCachedMemory()), baseMemory); // Wasm::Memory::TaggedArrayStoragePtr<void> (void*).
- jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs.sizeRegister, scratchOrSize);
+ jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
}
// Tail call into the callee WebAssembly function.
Modified: trunk/Source/_javascript_Core/wasm/js/JSToWasm.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/wasm/js/JSToWasm.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/wasm/js/JSToWasm.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -228,7 +228,7 @@
}
jit.loadPtr(CCallHelpers::Address(currentInstanceGPR, Wasm::Instance::offsetOfCachedMemory()), baseMemory);
- jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize, scratchOrSize);
+ jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
}
CCallHelpers::Call call = jit.threadSafePatchableNearCall();
Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp (246239 => 246240)
--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp 2019-06-09 20:28:18 UTC (rev 246240)
@@ -423,7 +423,7 @@
}
jit.loadPtr(CCallHelpers::Address(scratchGPR, Wasm::Instance::offsetOfCachedMemory()), baseMemory);
- jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize, scratchOrSize);
+ jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
}
// We use this callee to indicate how to unwind past these types of frames:
Modified: trunk/Source/bmalloc/ChangeLog (246239 => 246240)
--- trunk/Source/bmalloc/ChangeLog 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/bmalloc/ChangeLog 2019-06-09 20:28:18 UTC (rev 246240)
@@ -1,3 +1,24 @@
+2019-06-09 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r246150, r246160, and r246166.
+ https://bugs.webkit.org/show_bug.cgi?id=198698
+
+ Regresses page loading time on iOS 13 (Requested by keith_m__
+ on #webkit).
+
+ Reverted changesets:
+
+ "Reenable Gigacage on ARM64."
+ https://bugs.webkit.org/show_bug.cgi?id=198453
+ https://trac.webkit.org/changeset/246150
+
+ "Unrevied build fix for FTL without Gigacage."
+ https://trac.webkit.org/changeset/246160
+
+ "Fix typo in cageWithoutUntagging"
+ https://bugs.webkit.org/show_bug.cgi?id=198617
+ https://trac.webkit.org/changeset/246166
+
2019-06-06 Keith Miller <[email protected]>
Reenable Gigacage on ARM64.
Modified: trunk/Source/bmalloc/bmalloc/Gigacage.h (246239 => 246240)
--- trunk/Source/bmalloc/bmalloc/Gigacage.h 2019-06-09 20:03:16 UTC (rev 246239)
+++ trunk/Source/bmalloc/bmalloc/Gigacage.h 2019-06-09 20:28:18 UTC (rev 246240)
@@ -34,8 +34,7 @@
#include <cstddef>
#include <inttypes.h>
-#if ((BOS(DARWIN) || BOS(LINUX)) && \
- (BCPU(X86_64) || (BCPU(ARM64) && !defined(__ILP32__) && (!BPLATFORM(IOS_FAMILY) || BPLATFORM(IOS)))))
+#if ((BOS(DARWIN) || BOS(LINUX)) && BCPU(X86_64))
#define GIGACAGE_ENABLED 1
#else
#define GIGACAGE_ENABLED 0
