⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 184076 in webkit


Ignore:
Timestamp:
May 11, 2015, 4:04:08 AM (11 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r182827 - DFG register fillSpeculate*() functions should validate incoming spill format is compatible with requested fill format
​https://bugs.webkit.org/show_bug.cgi?id=143727

Reviewed by Geoffrey Garen.

Used the result of AbstractInterpreter<>::filter() to check that the current spill format is compatible
with the requested fill format. If filter() reports a contradiction, then we force an OSR exit.
Removed individual checks made redundant by the new check.

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):

Location:
releases/WebKitGTK/webkit-2.8/Source/JavaScriptCore
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.8/Source/JavaScriptCore/ChangeLog

    r182723 r184076  
     12015-04-14  Michael Saboff  <msaboff@apple.com>
     2
     3        DFG register fillSpeculate*() functions should validate incoming spill format is compatible with requested fill format
     4        https://bugs.webkit.org/show_bug.cgi?id=143727
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        Used the result of AbstractInterpreter<>::filter() to check that the current spill format is compatible
     9        with the requested fill format.  If filter() reports a contradiction, then we force an OSR exit.
     10        Removed individual checks made redundant by the new check.
     11
     12        * dfg/DFGSpeculativeJIT32_64.cpp:
     13        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
     14        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
     15        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
     16        * dfg/DFGSpeculativeJIT64.cpp:
     17        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
     18        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
     19        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
     20        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
     21
    1222015-04-10  Csaba Osztrogonác  <ossy@webkit.org>
    223

  • releases/WebKitGTK/webkit-2.8/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r182721 r184076  
    733733    SpeculatedType type = value.m_type;
    734734    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));
    735     m_interpreter.filter(value, SpecInt32);
    736     VirtualRegister virtualRegister = edge->virtualRegister();
    737     GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
    738 
    739     if (edge->hasConstant() && !edge->isInt32Constant()) {
     735
     736    if (m_interpreter.filter(value, SpecInt32) == Contradiction) {
    740737        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    741738        returnFormat = DataFormatInt32;
    742739        return allocate();
    743740    }
    744    
     741
     742    VirtualRegister virtualRegister = edge->virtualRegister();
     743    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
     744
    745745    switch (info.registerFormat()) {
    746746    case DataFormatNone: {
    … …  
    756756
    757757        DataFormat spillFormat = info.spillFormat();
    758 
    759         if (spillFormat == DataFormatCell) {
    760             terminateSpeculativeExecution(BadType, JSValueRegs(), edge);
    761             returnFormat = DataFormatInt32;
    762             return allocate();
    763         }
    764758
    765759        ASSERT_UNUSED(spillFormat, (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
    … …  
    808802    case DataFormatJSCell:
    809803    case DataFormatJSBoolean:
    810         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    811         returnFormat = DataFormatInt32;
    812         return allocate();
    813 
    814804    case DataFormatDouble:
    815805    case DataFormatStorage:
    … …  
    870860    SpeculatedType type = value.m_type;
    871861    ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
    872     m_interpreter.filter(value, SpecCell);
     862
     863    if (m_interpreter.filter(value, SpecCell) == Contradiction) {
     864        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
     865        return allocate();
     866    }
     867
    873868    VirtualRegister virtualRegister = edge->virtualRegister();
    874869    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
    875    
    876     if (edge->hasConstant() && !edge->isCellConstant()) {
    877         // Protect the silent spill/fill logic by failing early. If we "speculate" on
    878         // the constant then the silent filler may think that we have a cell and a
    879         // constant, so it will try to fill this as an cell constant. Bad things will
    880         // happen.
    881         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    882         return allocate();
    883     }
    884870
    885871    switch (info.registerFormat()) {
    886872    case DataFormatNone: {
    887         if (info.spillFormat() == DataFormatInt32) {
    888             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    889             return allocate();
    890         }
    891 
    892873        if (edge->hasConstant()) {
    893874            JSValue jsValue = edge->asJSValue();
    … …  
    947928    case DataFormatJSBoolean:
    948929    case DataFormatBoolean:
    949         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    950         return allocate();
    951 
    952930    case DataFormatDouble:
    953931    case DataFormatStorage:
    … …  
    964942    AbstractValue& value = m_state.forNode(edge);
    965943    SpeculatedType type = value.m_type;
    966     m_interpreter.filter(value, SpecBoolean);
     944
     945    if (m_interpreter.filter(value, SpecBoolean) == Contradiction) {
     946        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
     947        return allocate();
     948    }
     949
    967950    VirtualRegister virtualRegister = edge->virtualRegister();
    968951    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
    … …  
    970953    switch (info.registerFormat()) {
    971954    case DataFormatNone: {
    972         if (info.spillFormat() == DataFormatInt32) {
    973             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    974             return allocate();
    975         }
    976        
    977955        if (edge->hasConstant()) {
    978956            JSValue jsValue = edge->asJSValue();
    979957            GPRReg gpr = allocate();
    980             if (jsValue.isBoolean()) {
    981                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
    982                 m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
    983                 info.fillBoolean(*m_stream, gpr);
    984                 return gpr;
    985             }
    986             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
     958            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
     959            m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
     960            info.fillBoolean(*m_stream, gpr);
    987961            return gpr;
    988962        }
    … …  
    10281002    case DataFormatJSCell:
    10291003    case DataFormatCell:
    1030         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    1031         return allocate();
    1032 
    10331004    case DataFormatDouble:
    10341005    case DataFormatStorage:

  • releases/WebKitGTK/webkit-2.8/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r182711 r184076  
    709709    SpeculatedType type = value.m_type;
    710710    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));
    711     m_interpreter.filter(value, SpecInt32);
    712     VirtualRegister virtualRegister = edge->virtualRegister();
    713     GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
    714 
    715     if (edge->hasConstant() && !edge->isInt32Constant()) {
    716         // Protect the silent spill/fill logic by failing early. If we "speculate" on
    717         // the constant then the silent filler may think that we have an int32 and a
    718         // constant, so it will try to fill this as an int32 constant. Bad things will
    719         // happen.
     711
     712    if (m_interpreter.filter(value, SpecInt32) == Contradiction) {
    720713        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    721714        returnFormat = DataFormatInt32;
    722715        return allocate();
    723716    }
    724    
     717
     718    VirtualRegister virtualRegister = edge->virtualRegister();
     719    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
     720
    725721    switch (info.registerFormat()) {
    726722    case DataFormatNone: {
    … …  
    821817    case DataFormatBoolean:
    822818    case DataFormatJSCell:
    823     case DataFormatJSBoolean: {
    824         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    825         returnFormat = DataFormatInt32;
    826         return allocate();
    827     }
    828 
     819    case DataFormatJSBoolean:
    829820    case DataFormatDouble:
    830821    case DataFormatStorage:
    … …  
    859850    ASSERT(desiredFormat == DataFormatInt52 || desiredFormat == DataFormatStrictInt52);
    860851    AbstractValue& value = m_state.forNode(edge);
    861     m_interpreter.filter(value, SpecMachineInt);
     852
     853    if (m_interpreter.filter(value, SpecMachineInt) == Contradiction) {
     854        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
     855        return allocate();
     856    }
     857
    862858    VirtualRegister virtualRegister = edge->virtualRegister();
    863859    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
    … …  
    865861    switch (info.registerFormat()) {
    866862    case DataFormatNone: {
    867         if (edge->hasConstant() && !edge->isMachineIntConstant()) {
    868             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    869             return allocate();
    870         }
    871        
    872863        GPRReg gpr = allocate();
    873864
    … …  
    988979    SpeculatedType type = value.m_type;
    989980    ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
    990     m_interpreter.filter(value, SpecCell);
     981
     982    if (m_interpreter.filter(value, SpecCell) == Contradiction) {
     983        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
     984        return allocate();
     985    }
     986
    991987    VirtualRegister virtualRegister = edge->virtualRegister();
    992988    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
    993 
    994     if (edge->hasConstant() && !edge->isCellConstant()) {
    995         // Better to fail early on constants.
    996         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    997         return allocate();
    998     }
    999989
    1000990    switch (info.registerFormat()) {
    … …  
    1009999            return gpr;
    10101000        }
    1011        
    1012         if (!(info.spillFormat() & DataFormatJS)) {
    1013             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    1014             return gpr;
    1015         }
    1016        
     1001
    10171002        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
    10181003        m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
    … …  
    10501035    case DataFormatJSDouble:
    10511036    case DataFormatJSBoolean:
    1052     case DataFormatBoolean: {
    1053         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    1054         return allocate();
    1055     }
    1056 
     1037    case DataFormatBoolean:
    10571038    case DataFormatDouble:
    10581039    case DataFormatStorage:
    … …  
    10711052    AbstractValue& value = m_state.forNode(edge);
    10721053    SpeculatedType type = value.m_type;
    1073     m_interpreter.filter(value, SpecBoolean);
     1054
     1055    if (m_interpreter.filter(value, SpecBoolean) == Contradiction) {
     1056        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
     1057        return allocate();
     1058    }
     1059
    10741060    VirtualRegister virtualRegister = edge->virtualRegister();
    10751061    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
    … …  
    10771063    switch (info.registerFormat()) {
    10781064    case DataFormatNone: {
    1079         if (info.spillFormat() == DataFormatInt32) {
    1080             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    1081             return allocate();
    1082         }
    1083        
    10841065        GPRReg gpr = allocate();
    10851066
    10861067        if (edge->hasConstant()) {
    10871068            JSValue jsValue = edge->asJSValue();
    1088             if (jsValue.isBoolean()) {
    1089                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
    1090                 m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
    1091                 info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
    1092                 return gpr;
    1093             }
    1094             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
     1069            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
     1070            m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
     1071            info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
    10951072            return gpr;
    10961073        }
    … …  
    11331110    case DataFormatJSCell:
    11341111    case DataFormatCell:
    1135         terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
    1136         return allocate();
    1137        
    11381112    case DataFormatDouble:
    11391113    case DataFormatStorage:
Note: See TracChangeset for help on using the changeset viewer.