Diff
Modified: branches/safari-612-branch/Source/_javascript_Core/ChangeLog (285299 => 285300)
--- branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-11-04 19:40:18 UTC (rev 285299)
+++ branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-11-04 19:40:22 UTC (rev 285300)
@@ -1,5 +1,60 @@
2021-11-04 Russell Epstein <[email protected]>
+ Cherry-pick r285149. rdar://problem/81217357
+
+ [JSC] LLIntCallee should have two replacements
+ https://bugs.webkit.org/show_bug.cgi?id=228552
+ rdar://81217357
+
+ Reviewed by Saam Barati.
+
+ LLIntCallee can be used for signaling memory and bounds-checking memory.
+ Thus it should have two replacements for each mode.
+
+ * wasm/WasmBBQPlan.cpp:
+ (JSC::Wasm::BBQPlan::work):
+ * wasm/WasmCallee.h:
+ (JSC::Wasm::Callee::setOSREntryCallee):
+ * wasm/WasmOMGForOSREntryPlan.cpp:
+ (JSC::Wasm::OMGForOSREntryPlan::work):
+ * wasm/WasmOMGPlan.cpp:
+ (JSC::Wasm::OMGPlan::work):
+ * wasm/WasmPlan.cpp:
+ (JSC::Wasm::Plan::updateCallSitesToCallUs):
+ * wasm/WasmSlowPaths.cpp:
+ (JSC::LLInt::jitCompileAndSetHeuristics):
+ (JSC::LLInt::WASM_SLOW_PATH_DECL):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@285149 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-11-01 Yusuke Suzuki <[email protected]>
+
+ [JSC] LLIntCallee should have two replacements
+ https://bugs.webkit.org/show_bug.cgi?id=228552
+ rdar://81217357
+
+ Reviewed by Saam Barati.
+
+ LLIntCallee can be used for signaling memory and bounds-checking memory.
+ Thus it should have two replacements for each mode.
+
+ * wasm/WasmBBQPlan.cpp:
+ (JSC::Wasm::BBQPlan::work):
+ * wasm/WasmCallee.h:
+ (JSC::Wasm::Callee::setOSREntryCallee):
+ * wasm/WasmOMGForOSREntryPlan.cpp:
+ (JSC::Wasm::OMGForOSREntryPlan::work):
+ * wasm/WasmOMGPlan.cpp:
+ (JSC::Wasm::OMGPlan::work):
+ * wasm/WasmPlan.cpp:
+ (JSC::Wasm::Plan::updateCallSitesToCallUs):
+ * wasm/WasmSlowPaths.cpp:
+ (JSC::LLInt::jitCompileAndSetHeuristics):
+ (JSC::LLInt::WASM_SLOW_PATH_DECL):
+
+2021-11-04 Russell Epstein <[email protected]>
+
Cherry-pick r285117. rdar://problem/84402043
JSGenericTypedArrayView<Adaptor>::set crashes if the length + objectOffset is > UINT32_MAX
Modified: branches/safari-612-branch/Source/_javascript_Core/wasm/WasmBBQPlan.cpp (285299 => 285300)
--- branches/safari-612-branch/Source/_javascript_Core/wasm/WasmBBQPlan.cpp 2021-11-04 19:40:18 UTC (rev 285299)
+++ branches/safari-612-branch/Source/_javascript_Core/wasm/WasmBBQPlan.cpp 2021-11-04 19:40:22 UTC (rev 285300)
@@ -150,7 +150,7 @@
{
LLIntCallee& llintCallee = m_codeBlock->m_llintCallees->at(m_functionIndex).get();
Locker locker { llintCallee.tierUpCounter().m_lock };
- llintCallee.setReplacement(callee.copyRef());
+ llintCallee.setReplacement(callee.copyRef(), mode());
llintCallee.tierUpCounter().m_compilationStatus = LLIntTierUpCounter::CompilationStatus::Compiled;
}
}
Modified: branches/safari-612-branch/Source/_javascript_Core/wasm/WasmCallee.h (285299 => 285300)
--- branches/safari-612-branch/Source/_javascript_Core/wasm/WasmCallee.h 2021-11-04 19:40:18 UTC (rev 285299)
+++ branches/safari-612-branch/Source/_javascript_Core/wasm/WasmCallee.h 2021-11-04 19:40:22 UTC (rev 285300)
@@ -66,7 +66,7 @@
bool hasExceptionHandlers() const { return !!m_exceptionHandlers.size(); }
#if ENABLE(WEBASSEMBLY_B3JIT)
- virtual void setOSREntryCallee(Ref<OMGForOSREntryCallee>&&)
+ virtual void setOSREntryCallee(Ref<OMGForOSREntryCallee>&&, MemoryMode)
{
RELEASE_ASSERT_NOT_REACHED();
}
@@ -193,7 +193,7 @@
}
OMGForOSREntryCallee* osrEntryCallee() { return m_osrEntryCallee.get(); }
- void setOSREntryCallee(Ref<OMGForOSREntryCallee>&& osrEntryCallee) final
+ void setOSREntryCallee(Ref<OMGForOSREntryCallee>&& osrEntryCallee, MemoryMode) final
{
m_osrEntryCallee = WTFMove(osrEntryCallee);
}
@@ -238,16 +238,16 @@
JS_EXPORT_PRIVATE std::tuple<void*, void*> range() const final;
#if ENABLE(WEBASSEMBLY_B3JIT)
- JITCallee* replacement() { return m_replacement.get(); }
- void setReplacement(Ref<JITCallee>&& replacement)
+ JITCallee* replacement(MemoryMode mode) { return m_replacements[static_cast<uint8_t>(mode)].get(); }
+ void setReplacement(Ref<JITCallee>&& replacement, MemoryMode mode)
{
- m_replacement = WTFMove(replacement);
+ m_replacements[static_cast<uint8_t>(mode)] = WTFMove(replacement);
}
- OMGForOSREntryCallee* osrEntryCallee() { return m_osrEntryCallee.get(); }
- void setOSREntryCallee(Ref<OMGForOSREntryCallee>&& osrEntryCallee) final
+ OMGForOSREntryCallee* osrEntryCallee(MemoryMode mode) { return m_osrEntryCallees[static_cast<uint8_t>(mode)].get(); }
+ void setOSREntryCallee(Ref<OMGForOSREntryCallee>&& osrEntryCallee, MemoryMode mode) final
{
- m_osrEntryCallee = WTFMove(osrEntryCallee);
+ m_osrEntryCallees[static_cast<uint8_t>(mode)] = WTFMove(osrEntryCallee);
}
LLIntTierUpCounter& tierUpCounter() { return m_codeBlock->tierUpCounter(); }
@@ -260,8 +260,8 @@
void linkExceptionHandlers();
#if ENABLE(WEBASSEMBLY_B3JIT)
- RefPtr<JITCallee> m_replacement;
- RefPtr<OMGForOSREntryCallee> m_osrEntryCallee;
+ RefPtr<JITCallee> m_replacements[Wasm::NumberOfMemoryModes];
+ RefPtr<OMGForOSREntryCallee> m_osrEntryCallees[Wasm::NumberOfMemoryModes];
#endif
std::unique_ptr<FunctionCodeBlock> m_codeBlock;
MacroAssemblerCodePtr<WasmEntryPtrTag> m_entrypoint;
Modified: branches/safari-612-branch/Source/_javascript_Core/wasm/WasmOMGForOSREntryPlan.cpp (285299 => 285300)
--- branches/safari-612-branch/Source/_javascript_Core/wasm/WasmOMGForOSREntryPlan.cpp 2021-11-04 19:40:18 UTC (rev 285299)
+++ branches/safari-612-branch/Source/_javascript_Core/wasm/WasmOMGForOSREntryPlan.cpp 2021-11-04 19:40:22 UTC (rev 285300)
@@ -125,7 +125,7 @@
case CompilationMode::LLIntMode: {
LLIntCallee* llintCallee = static_cast<LLIntCallee*>(m_callee.ptr());
Locker locker { llintCallee->tierUpCounter().m_lock };
- llintCallee->setOSREntryCallee(callee.copyRef());
+ llintCallee->setOSREntryCallee(callee.copyRef(), mode());
llintCallee->tierUpCounter().m_loopCompilationStatus = LLIntTierUpCounter::CompilationStatus::Compiled;
break;
}
@@ -132,7 +132,7 @@
case CompilationMode::BBQMode: {
BBQCallee* bbqCallee = static_cast<BBQCallee*>(m_callee.ptr());
Locker locker { bbqCallee->tierUpCount()->getLock() };
- bbqCallee->setOSREntryCallee(callee.copyRef());
+ bbqCallee->setOSREntryCallee(callee.copyRef(), mode());
bbqCallee->tierUpCount()->osrEntryTriggers()[m_loopIndex] = TierUpCount::TriggerReason::CompilationDone;
bbqCallee->tierUpCount()->m_compilationStatusForOMGForOSREntry = TierUpCount::CompilationStatus::Compiled;
break;
Modified: branches/safari-612-branch/Source/_javascript_Core/wasm/WasmOMGPlan.cpp (285299 => 285300)
--- branches/safari-612-branch/Source/_javascript_Core/wasm/WasmOMGPlan.cpp 2021-11-04 19:40:18 UTC (rev 285299)
+++ branches/safari-612-branch/Source/_javascript_Core/wasm/WasmOMGPlan.cpp 2021-11-04 19:40:22 UTC (rev 285300)
@@ -135,7 +135,7 @@
if (m_codeBlock->m_llintCallees) {
LLIntCallee& llintCallee = m_codeBlock->m_llintCallees->at(m_functionIndex).get();
Locker locker { llintCallee.tierUpCounter().m_lock };
- llintCallee.setReplacement(callee.copyRef());
+ llintCallee.setReplacement(callee.copyRef(), mode());
llintCallee.tierUpCounter().m_compilationStatus = LLIntTierUpCounter::CompilationStatus::Compiled;
}
}
Modified: branches/safari-612-branch/Source/_javascript_Core/wasm/WasmPlan.cpp (285299 => 285300)
--- branches/safari-612-branch/Source/_javascript_Core/wasm/WasmPlan.cpp 2021-11-04 19:40:18 UTC (rev 285299)
+++ branches/safari-612-branch/Source/_javascript_Core/wasm/WasmPlan.cpp 2021-11-04 19:40:22 UTC (rev 285300)
@@ -139,9 +139,9 @@
stageRepatch(codeBlock.m_wasmToWasmCallsites[i]);
if (codeBlock.m_llintCallees) {
LLIntCallee& llintCallee = codeBlock.m_llintCallees->at(i).get();
- if (JITCallee* replacementCallee = llintCallee.replacement())
+ if (JITCallee* replacementCallee = llintCallee.replacement(codeBlock.mode()))
stageRepatch(replacementCallee->wasmToWasmCallsites());
- if (OMGForOSREntryCallee* osrEntryCallee = llintCallee.osrEntryCallee())
+ if (OMGForOSREntryCallee* osrEntryCallee = llintCallee.osrEntryCallee(codeBlock.mode()))
stageRepatch(osrEntryCallee->wasmToWasmCallsites());
}
if (BBQCallee* bbqCallee = codeBlock.m_bbqCallees[i].get()) {
@@ -174,9 +174,9 @@
repatchCalls(codeBlock.m_wasmToWasmCallsites[i]);
if (codeBlock.m_llintCallees) {
LLIntCallee& llintCallee = codeBlock.m_llintCallees->at(i).get();
- if (JITCallee* replacementCallee = llintCallee.replacement())
+ if (JITCallee* replacementCallee = llintCallee.replacement(codeBlock.mode()))
repatchCalls(replacementCallee->wasmToWasmCallsites());
- if (OMGForOSREntryCallee* osrEntryCallee = llintCallee.osrEntryCallee())
+ if (OMGForOSREntryCallee* osrEntryCallee = llintCallee.osrEntryCallee(codeBlock.mode()))
repatchCalls(osrEntryCallee->wasmToWasmCallsites());
}
if (BBQCallee* bbqCallee = codeBlock.m_bbqCallees[i].get()) {
Modified: branches/safari-612-branch/Source/_javascript_Core/wasm/WasmSlowPaths.cpp (285299 => 285300)
--- branches/safari-612-branch/Source/_javascript_Core/wasm/WasmSlowPaths.cpp 2021-11-04 19:40:18 UTC (rev 285299)
+++ branches/safari-612-branch/Source/_javascript_Core/wasm/WasmSlowPaths.cpp 2021-11-04 19:40:22 UTC (rev 285300)
@@ -106,7 +106,7 @@
return false;
}
- if (callee->replacement()) {
+ if (callee->replacement(instance->memory()->mode())) {
dataLogLnIf(Options::verboseOSR(), " Code was already compiled.");
tierUpCounter.optimizeSoon();
return true;
@@ -143,7 +143,7 @@
tierUpCounter.optimizeAfterWarmUp();
}
- return !!callee->replacement();
+ return !!callee->replacement(instance->memory()->mode());
}
WASM_SLOW_PATH_DECL(prologue_osr)
@@ -166,7 +166,7 @@
if (!jitCompileAndSetHeuristics(callee, codeBlock, instance))
WASM_RETURN_TWO(nullptr, nullptr);
- WASM_RETURN_TWO(callee->replacement()->entrypoint().executableAddress(), nullptr);
+ WASM_RETURN_TWO(callee->replacement(instance->memory()->mode())->entrypoint().executableAddress(), nullptr);
}
WASM_SLOW_PATH_DECL(loop_osr)
@@ -190,8 +190,7 @@
WASM_RETURN_TWO(nullptr, nullptr);
}
- const auto doOSREntry = [&] {
- Wasm::OMGForOSREntryCallee* osrEntryCallee = callee->osrEntryCallee();
+ const auto doOSREntry = [&](Wasm::OMGForOSREntryCallee* osrEntryCallee) {
if (osrEntryCallee->loopIndex() != osrEntryData.loopIndex)
WASM_RETURN_TWO(nullptr, nullptr);
@@ -208,8 +207,8 @@
WASM_RETURN_TWO(buffer, osrEntryCallee->entrypoint().executableAddress());
};
- if (callee->osrEntryCallee())
- return doOSREntry();
+ if (auto* osrEntryCallee = callee->osrEntryCallee(instance->memory()->mode()))
+ return doOSREntry(osrEntryCallee);
bool compile = false;
{
@@ -236,8 +235,8 @@
tierUpCounter.optimizeAfterWarmUp();
}
- if (callee->osrEntryCallee())
- return doOSREntry();
+ if (auto* osrEntryCallee = callee->osrEntryCallee(instance->memory()->mode()))
+ return doOSREntry(osrEntryCallee);
WASM_RETURN_TWO(nullptr, nullptr);
}
