Title: [249184] trunk/Source/_javascript_Core
Revision
249184
Author
[email protected]
Date
2019-08-27 16:48:54 -0700 (Tue, 27 Aug 2019)

Log Message

Update PACCage changes for builds without Gigacage, but with signed pointers
https://bugs.webkit.org/show_bug.cgi?id=201202

Reviewed by Saam Barati.

Factored out the untagging of pointers and added that to both the Gigacage enabled
and disabled code paths.  Did this for the LLInt as well as the JITs.

* _javascript_Core.xcodeproj/project.pbxproj: Added arm64e.rb to offlineasm file list.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::caged):
* llint/LowLevelInterpreter64.asm:

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (249183 => 249184)


--- trunk/Source/_javascript_Core/ChangeLog	2019-08-27 23:39:38 UTC (rev 249183)
+++ trunk/Source/_javascript_Core/ChangeLog	2019-08-27 23:48:54 UTC (rev 249184)
@@ -1,3 +1,20 @@
+2019-08-27  Michael Saboff  <[email protected]>
+
+        Update PACCage changes for builds without Gigacage, but with signed pointers
+        https://bugs.webkit.org/show_bug.cgi?id=201202
+
+        Reviewed by Saam Barati.
+
+        Factored out the untagging of pointers and added that to both the Gigacage enabled
+        and disabled code paths.  Did this for the LLInt as well as the JITs.
+
+        * _javascript_Core.xcodeproj/project.pbxproj: Added arm64e.rb to offlineasm file list.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::caged):
+        * llint/LowLevelInterpreter64.asm:
+
 2019-08-27  Mark Lam  <[email protected]>
 
         Refactor to use VM& instead of VM* at as many places as possible.

Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (249183 => 249184)


--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2019-08-27 23:39:38 UTC (rev 249183)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2019-08-27 23:48:54 UTC (rev 249184)
@@ -3861,6 +3861,7 @@
 		65A946141C8E9F6F00A7209A /* YarrCanonicalizeUnicode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = YarrCanonicalizeUnicode.cpp; sourceTree = "<group>"; };
 		65B8392C1BACA92A0044E824 /* CachedRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedRecovery.h; sourceTree = "<group>"; };
 		65B8392D1BACA9D30044E824 /* CachedRecovery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedRecovery.cpp; sourceTree = "<group>"; };
+		65B898AD23146E9B00476358 /* arm64e.rb */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.ruby; path = arm64e.rb; sourceTree = "<group>"; };
 		65C02FBB0637462A003E7EE6 /* Protect.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Protect.h; sourceTree = "<group>"; tabWidth = 8; };
 		65C6BEDF21128C3B006849C3 /* YarrDisassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrDisassembler.cpp; path = yarr/YarrDisassembler.cpp; sourceTree = "<group>"; };
 		65C6BEE021128C3B006849C3 /* YarrDisassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrDisassembler.h; path = yarr/YarrDisassembler.h; sourceTree = "<group>"; };
@@ -8656,6 +8657,7 @@
 			children = (
 				FEF3475520362B1C00B7C0EF /* arm.rb */,
 				FEF3476220362B2200B7C0EF /* arm64.rb */,
+				65B898AD23146E9B00476358 /* arm64e.rb */,
 				FEF3475920362B1D00B7C0EF /* asm.rb */,
 				FEF3475820362B1D00B7C0EF /* ast.rb */,
 				FEF3475620362B1C00B7C0EF /* backends.rb */,

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (249183 => 249184)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2019-08-27 23:39:38 UTC (rev 249183)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2019-08-27 23:48:54 UTC (rev 249184)
@@ -6784,28 +6784,35 @@
 
 void SpeculativeJIT::cageTypedArrayStorage(GPRReg baseReg, GPRReg storageReg)
 {
+    auto untagArrayPtr = [&]() {
 #if CPU(ARM64E)
-    m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
+        m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
 #else
-    UNUSED_PARAM(baseReg);
-    UNUSED_PARAM(storageReg);
+        UNUSED_PARAM(baseReg);
+        UNUSED_PARAM(storageReg);
 #endif
+    };
 
 #if GIGACAGE_ENABLED
     UNUSED_PARAM(baseReg);
-    if (!Gigacage::shouldBeEnabled())
+    if (!Gigacage::shouldBeEnabled()) {
+        untagArrayPtr();
         return;
+    }
     
     if (Gigacage::canPrimitiveGigacageBeDisabled()) {
         VM& vm = this->vm();
         if (vm.primitiveGigacageEnabled().isStillValid())
             m_jit.graph().watchpoints().addLazily(vm.primitiveGigacageEnabled());
-        else
+        else {
+            untagArrayPtr();
             return;
+        }
     }
     
     m_jit.cageWithoutUntagging(Gigacage::Primitive, storageReg);
 #endif
+    untagArrayPtr();
 }
 
 void SpeculativeJIT::compileGetIndexedPropertyStorage(Node* node)

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (249183 => 249184)


--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2019-08-27 23:39:38 UTC (rev 249183)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2019-08-27 23:48:54 UTC (rev 249184)
@@ -14190,15 +14190,28 @@
 
     LValue caged(Gigacage::Kind kind, LValue ptr, LValue base)
     {
+        auto doUntagArrayPtr = [&](LValue taggedPtr) {
+#if CPU(ARM64E)
+            if (kind == Gigacage::Primitive) {
+                LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
+                return untagArrayPtr(taggedPtr, size);
+            }
+            return ptr;
+#else
+            UNUSED_PARAM(taggedPtr);
+            return ptr;
+#endif
+        };
+
 #if GIGACAGE_ENABLED
         if (!Gigacage::isEnabled(kind))
-            return ptr;
+            return doUntagArrayPtr(ptr);
         
         if (kind == Gigacage::Primitive && Gigacage::canPrimitiveGigacageBeDisabled()) {
             if (vm().primitiveGigacageEnabled().isStillValid())
                 m_graph.watchpoints().addLazily(vm().primitiveGigacageEnabled());
             else
-                return ptr;
+                return doUntagArrayPtr(ptr);
         }
         
         LValue basePtr = m_out.constIntPtr(Gigacage::basePtr(kind));
@@ -14217,8 +14230,7 @@
                 jit.bitFieldInsert64(params[1].gpr(), 0, 64 - MacroAssembler::numberOfPACBits, params[0].gpr());
             });
 
-            LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
-            result = untagArrayPtr(merge, size);
+            result = doUntagArrayPtr(merge);
         }
 #endif // CPU(ARM64E)
 
@@ -14238,7 +14250,7 @@
 
         UNUSED_PARAM(kind);
         UNUSED_PARAM(base);
-        return ptr;
+        return doUntagArrayPtr(ptr);
     }
     
     void buildSwitch(SwitchData* data, LType type, LValue switchValue)

Modified: trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm (249183 => 249184)


--- trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm	2019-08-27 23:39:38 UTC (rev 249183)
+++ trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm	2019-08-27 23:48:54 UTC (rev 249184)
@@ -444,9 +444,11 @@
         if ARM64E
             const numberOfPACBits = constexpr MacroAssembler::numberOfPACBits
             bfiq scratch2, 0, 64 - numberOfPACBits, ptr
-            untagArrayPtr length, ptr
         end
     end
+    if ARM64E
+        untagArrayPtr length, ptr
+    end
 end
 
 macro loadCagedJSValue(source, dest, scratchOrLength)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to