- Revision
- 271352
- Author
- [email protected]
- Date
- 2021-01-10 21:40:00 -0800 (Sun, 10 Jan 2021)
Log Message
[JSC] JITCage's Gate mechanism is used in ARM64E even if JITCage is disable
https://bugs.webkit.org/show_bug.cgi?id=220500
Reviewed by Mark Lam.
We should ensure that Gate mechanism just works even if ENABLE(JIT_CAGE) is OFF in ARM64E since
in LLInt we are always using Gate even if ENABLE(JIT_CAGE) is OFF. It makes LLInt code
significantly simpler: we do not want to have multiple implementations for ARM64E for ENABLE(JIT_CAGE) ON/OFF
in LLInt if it is not necessary in terms of performance. And it didn't cause performance regression.
So for simplicity, we are always using Gate in LLInt.
However, when disabling ENABLE(JIT_CAGE), we accidentally disabled Gate mechanism too in LLInt.
It makes ARM64E broken if ENABLE(JIT_CAGE) is OFF. This patch makes Gate work even if ENABLE(JIT_CAGE) is OFF,
and this is the expected design.
* llint/LLIntData.cpp:
(JSC::LLInt::initialize):
* llint/LLIntEntrypoint.cpp:
(JSC::LLInt::setFunctionEntrypoint):
(JSC::LLInt::setEvalEntrypoint):
(JSC::LLInt::setProgramEntrypoint):
(JSC::LLInt::setModuleProgramEntrypoint):
* llint/LLIntThunks.cpp:
* llint/LLIntThunks.h:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (271351 => 271352)
--- trunk/Source/_javascript_Core/ChangeLog 2021-01-10 19:13:01 UTC (rev 271351)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-01-11 05:40:00 UTC (rev 271352)
@@ -1,3 +1,30 @@
+2021-01-10 Yusuke Suzuki <[email protected]>
+
+ [JSC] JITCage's Gate mechanism is used in ARM64E even if JITCage is disable
+ https://bugs.webkit.org/show_bug.cgi?id=220500
+
+ Reviewed by Mark Lam.
+
+ We should ensure that Gate mechanism just works even if ENABLE(JIT_CAGE) is OFF in ARM64E since
+ in LLInt we are always using Gate even if ENABLE(JIT_CAGE) is OFF. It makes LLInt code
+ significantly simpler: we do not want to have multiple implementations for ARM64E for ENABLE(JIT_CAGE) ON/OFF
+ in LLInt if it is not necessary in terms of performance. And it didn't cause performance regression.
+ So for simplicity, we are always using Gate in LLInt.
+
+ However, when disabling ENABLE(JIT_CAGE), we accidentally disabled Gate mechanism too in LLInt.
+ It makes ARM64E broken if ENABLE(JIT_CAGE) is OFF. This patch makes Gate work even if ENABLE(JIT_CAGE) is OFF,
+ and this is the expected design.
+
+ * llint/LLIntData.cpp:
+ (JSC::LLInt::initialize):
+ * llint/LLIntEntrypoint.cpp:
+ (JSC::LLInt::setFunctionEntrypoint):
+ (JSC::LLInt::setEvalEntrypoint):
+ (JSC::LLInt::setProgramEntrypoint):
+ (JSC::LLInt::setModuleProgramEntrypoint):
+ * llint/LLIntThunks.cpp:
+ * llint/LLIntThunks.h:
+
2021-01-08 Alexey Shvayka <[email protected]>
Implement @copyDataProperties in C++ to optimize object rest / spread
Modified: trunk/Source/_javascript_Core/llint/LLIntData.cpp (271351 => 271352)
--- trunk/Source/_javascript_Core/llint/LLIntData.cpp 2021-01-10 19:13:01 UTC (rev 271351)
+++ trunk/Source/_javascript_Core/llint/LLIntData.cpp 2021-01-11 05:40:00 UTC (rev 271352)
@@ -54,7 +54,7 @@
#endif // !ENABLE(C_LOOP)
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
extern "C" void vmEntryToJavaScriptTrampoline(void);
extern "C" void tailCallJSEntryTrampoline(void);
extern "C" void tailCallJSEntrySlowPathTrampoline(void);
@@ -89,9 +89,12 @@
JITOperationList::populatePointersInJavaScriptCoreForLLInt();
+#if CPU(ARM64E)
+
#if ENABLE(JIT_CAGE)
if (Options::useJITCage())
g_jscConfig.llint.gateMap[static_cast<unsigned>(Gate::jitCagePtr)] = jitCagePtrThunk().code().executableAddress();
+#endif
#define INITIALIZE_JS_GATE(name, tag) \
do { \
@@ -203,7 +206,7 @@
INITIALIZE_TAG_AND_UNTAG_THUNKS(llint_function_for_call_arity_check);
INITIALIZE_TAG_AND_UNTAG_THUNKS(llint_function_for_construct_arity_check);
-#endif // ENABLE(JIT_CAGE)
+#endif // CPU(ARM64E)
#endif // ENABLE(C_LOOP)
}
Modified: trunk/Source/_javascript_Core/llint/LLIntEntrypoint.cpp (271351 => 271352)
--- trunk/Source/_javascript_Core/llint/LLIntEntrypoint.cpp 2021-01-10 19:13:01 UTC (rev 271351)
+++ trunk/Source/_javascript_Core/llint/LLIntEntrypoint.cpp 2021-01-11 05:40:00 UTC (rev 271352)
@@ -35,7 +35,7 @@
namespace JSC { namespace LLInt {
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
extern "C" void jsTrampolineProgramPrologue(void);
extern "C" void jsTrampolineModuleProgramPrologue(void);
extern "C" void jsTrampolineEvalPrologue(void);
@@ -88,7 +88,7 @@
static DirectJITCode* jitCode;
static std::once_flag onceKey;
std::call_once(onceKey, [&] {
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
jitCode = new DirectJITCode(entrypointTrampoline(jsTrampolineFunctionForCallPrologue), entrypointTrampoline(jsTrampolineFunctionForCallArityCheckPrologue).code(), JITType::InterpreterThunk, JITCode::ShareAttribute::Shared);
#else
jitCode = new DirectJITCode(getCodeRef<JSEntryPtrTag>(llint_function_for_call_prologue), getCodePtr<JSEntryPtrTag>(llint_function_for_call_arity_check), JITType::InterpreterThunk, JITCode::ShareAttribute::Shared);
@@ -99,7 +99,7 @@
static DirectJITCode* jitCode;
static std::once_flag onceKey;
std::call_once(onceKey, [&] {
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
jitCode = new DirectJITCode(entrypointTrampoline(jsTrampolineFunctionForConstructPrologue), entrypointTrampoline(jsTrampolineFunctionForConstructArityCheckPrologue).code(), JITType::InterpreterThunk, JITCode::ShareAttribute::Shared);
#else
jitCode = new DirectJITCode(getCodeRef<JSEntryPtrTag>(llint_function_for_construct_prologue), getCodePtr<JSEntryPtrTag>(llint_function_for_construct_arity_check), JITType::InterpreterThunk, JITCode::ShareAttribute::Shared);
@@ -127,7 +127,7 @@
static NativeJITCode* jitCode;
static std::once_flag onceKey;
std::call_once(onceKey, [&] {
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
jitCode = new NativeJITCode(entrypointTrampoline(jsTrampolineEvalPrologue), JITType::InterpreterThunk, Intrinsic::NoIntrinsic, JITCode::ShareAttribute::Shared);
#else
jitCode = new NativeJITCode(getCodeRef<JSEntryPtrTag>(llint_eval_prologue), JITType::InterpreterThunk, Intrinsic::NoIntrinsic, JITCode::ShareAttribute::Shared);
@@ -154,7 +154,7 @@
static NativeJITCode* jitCode;
static std::once_flag onceKey;
std::call_once(onceKey, [&] {
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
jitCode = new NativeJITCode(entrypointTrampoline(jsTrampolineProgramPrologue), JITType::InterpreterThunk, Intrinsic::NoIntrinsic, JITCode::ShareAttribute::Shared);
#else
jitCode = new NativeJITCode(getCodeRef<JSEntryPtrTag>(llint_program_prologue), JITType::InterpreterThunk, Intrinsic::NoIntrinsic, JITCode::ShareAttribute::Shared);
@@ -181,7 +181,7 @@
static NativeJITCode* jitCode;
static std::once_flag onceKey;
std::call_once(onceKey, [&] {
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
jitCode = new NativeJITCode(entrypointTrampoline(jsTrampolineModuleProgramPrologue), JITType::InterpreterThunk, Intrinsic::NoIntrinsic, JITCode::ShareAttribute::Shared);
#else
jitCode = new NativeJITCode(getCodeRef<JSEntryPtrTag>(llint_module_program_prologue), JITType::InterpreterThunk, Intrinsic::NoIntrinsic, JITCode::ShareAttribute::Shared);
Modified: trunk/Source/_javascript_Core/llint/LLIntThunks.cpp (271351 => 271352)
--- trunk/Source/_javascript_Core/llint/LLIntThunks.cpp 2021-01-10 19:13:01 UTC (rev 271351)
+++ trunk/Source/_javascript_Core/llint/LLIntThunks.cpp 2021-01-11 05:40:00 UTC (rev 271352)
@@ -40,7 +40,7 @@
#if ENABLE(JIT)
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
#define JSC_ANNOTATE_LLINT_JIT_OPERATION(name) \
JSC_ANNOTATE_JIT_OPERATION(_JITTarget_##name, name)
@@ -343,7 +343,7 @@
return codeRef;
}
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
MacroAssemblerCodeRef<NativeToJITGatePtrTag> createJSGateThunk(void* pointer, PtrTag tag, const char* name)
{
@@ -487,6 +487,10 @@
return FINALIZE_CODE(patchBuffer, NativeToJITGatePtrTag, "untag thunk");
}
+#endif // CPU(ARM64E)
+
+#if ENABLE(JIT_CAGE)
+
MacroAssemblerCodeRef<NativeToJITGatePtrTag> jitCagePtrThunk()
{
static LazyNeverDestroyed<MacroAssemblerCodeRef<NativeToJITGatePtrTag>> codeRef;
Modified: trunk/Source/_javascript_Core/llint/LLIntThunks.h (271351 => 271352)
--- trunk/Source/_javascript_Core/llint/LLIntThunks.h 2021-01-10 19:13:01 UTC (rev 271351)
+++ trunk/Source/_javascript_Core/llint/LLIntThunks.h 2021-01-11 05:40:00 UTC (rev 271352)
@@ -42,7 +42,7 @@
EncodedJSValue vmEntryHostFunction(JSGlobalObject*, CallFrame*, void*);
}
-#if ENABLE(JIT_CAGE)
+#if CPU(ARM64E)
extern "C" {
void jitCagePtrGateAfter(void);
void vmEntryToJavaScriptGateAfter(void);
@@ -80,7 +80,11 @@
MacroAssemblerCodeRef<ExceptionHandlerPtrTag> handleUncaughtExceptionThunk();
MacroAssemblerCodeRef<ExceptionHandlerPtrTag> handleCatchThunk(OpcodeSize);
+#if ENABLE(JIT_CAGE)
MacroAssemblerCodeRef<NativeToJITGatePtrTag> jitCagePtrThunk();
+#endif
+
+#if CPU(ARM64E)
MacroAssemblerCodeRef<NativeToJITGatePtrTag> createJSGateThunk(void*, PtrTag, const char*);
MacroAssemblerCodeRef<NativeToJITGatePtrTag> createWasmGateThunk(void*, PtrTag, const char*);
MacroAssemblerCodeRef<NativeToJITGatePtrTag> createTailCallGate(PtrTag);
@@ -91,6 +95,7 @@
MacroAssemblerCodeRef<NativeToJITGatePtrTag> returnFromLLIntGateThunk();
MacroAssemblerCodeRef<NativeToJITGatePtrTag> untagGateThunk(void*);
MacroAssemblerCodeRef<NativeToJITGatePtrTag> tagGateThunk(void*);
+#endif
MacroAssemblerCodeRef<JSEntryPtrTag> normalOSRExitTrampolineThunk();
#if ENABLE(DFG_JIT)
