⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 220184 in webkit


Ignore:
Timestamp:
Aug 2, 2017, 10:48:59 PM (9 years ago)
Author:
fpizlo@apple.com
Message:

LLInt should do pointer caging
​https://bugs.webkit.org/show_bug.cgi?id=175036

Reviewed by Keith Miller.

Implementing this in the LLInt was challenging because offlineasm did not previously know
how to load from globals. This teaches it how to do that on Darwin/x86_64, which happens
to be where the Gigacage is enabled right now.

  • llint/LLIntOfflineAsmConfig.h:
  • llint/LowLevelInterpreter64.asm:
  • offlineasm/ast.rb:
  • offlineasm/x86.rb:
Location:
trunk/Source/JavaScriptCore
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r220175 r220184  
     12017-08-02  Filip Pizlo  <fpizlo@apple.com>
     2
     3        LLInt should do pointer caging
     4        https://bugs.webkit.org/show_bug.cgi?id=175036
     5
     6        Reviewed by Keith Miller.
     7
     8        Implementing this in the LLInt was challenging because offlineasm did not previously know
     9        how to load from globals. This teaches it how to do that on Darwin/x86_64, which happens
     10        to be where the Gigacage is enabled right now.
     11
     12        * llint/LLIntOfflineAsmConfig.h:
     13        * llint/LowLevelInterpreter64.asm:
     14        * offlineasm/ast.rb:
     15        * offlineasm/x86.rb:
     16
    1172017-08-02  Filip Pizlo  <fpizlo@apple.com>
    218

  • trunk/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h

    r218794 r220184  
    2828#include "LLIntCommon.h"
    2929#include <wtf/Assertions.h>
     30#include <wtf/Gigacage.h>
    3031
    3132#if !ENABLE(JIT)
    … …  
    165166#define OFFLINE_ASM_EXECUTION_TRACING 0
    166167#endif
     168
     169#define OFFLINE_ASM_GIGACAGE_ENABLED GIGACAGE_ENABLED

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r220118 r220184  
    377377end
    378378
     379macro loadCaged(source, dest, scratch)
     380    loadp source, dest
     381    if GIGACAGE_ENABLED and not C_LOOP
     382        loadp _g_gigacageBasePtr, scratch
     383        btpz scratch, .done
     384        andp constexpr GIGACAGE_MASK, dest
     385        addp scratch, dest
     386    .done:
     387    end
     388end
     389
    379390macro loadVariable(operand, value)
    380391    loadisFromInstruction(operand, value)
    … …  
    11991210macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
    12001211    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
    1201     # FIXME: Should do caging
    1202     # https://bugs.webkit.org/show_bug.cgi?id=175036
    1203     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
     1212    loadCaged(JSObject::m_butterfly[objectAndStorage], objectAndStorage, value)
    12041213    negi propertyOffsetAsInt
    12051214    sxi2q propertyOffsetAsInt, propertyOffsetAsInt
    … …  
    12121221
    12131222
    1214 macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
     1223macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value, scratch)
    12151224    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
    1216     # FIXME: Should do caging
    1217     # https://bugs.webkit.org/show_bug.cgi?id=175036
    1218     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
     1225    loadCaged(JSObject::m_butterfly[objectAndStorage], objectAndStorage, scratch)
    12191226    negi propertyOffsetAsInt
    12201227    sxi2q propertyOffsetAsInt, propertyOffsetAsInt
    … …  
    12921299    btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
    12931300    loadisFromInstruction(1, t1)
    1294     # FIXME: Should do caging
    1295     # https://bugs.webkit.org/show_bug.cgi?id=175036
    1296     loadp JSObject::m_butterfly[t3], t0
     1301    loadCaged(JSObject::m_butterfly[t3], t0, t2)
    12971302    loadi -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], t0
    12981303    bilt t0, 0, .opGetArrayLengthSlow
    … …  
    14411446    loadConstantOrVariable(t1, t2)
    14421447    loadisFromInstruction(5, t1)
    1443     storePropertyAtVariableOffset(t1, t0, t2)
     1448    storePropertyAtVariableOffset(t1, t0, t2, t3)
    14441449    writeBarrierOnOperands(1, 3)
    14451450    dispatch(constexpr op_put_by_id_length)
    … …  
    14771482    loadConstantOrVariableInt32(t3, t1, .opGetByValSlow)
    14781483    sxi2q t1, t1
    1479     # FIXME: Should do caging
    1480     # https://bugs.webkit.org/show_bug.cgi?id=175036
    1481     loadp JSObject::m_butterfly[t0], t3
     1484    loadCaged(JSObject::m_butterfly[t0], t3, t5)
    14821485    andi IndexingShapeMask, t2
    14831486    bieq t2, Int32Shape, .opGetByValIsContiguous
    … …  
    15261529   
    15271530    # Sweet, now we know that we have a typed array. Do some basic things now.
    1528     # FIXME: Should do caging
    1529     # https://bugs.webkit.org/show_bug.cgi?id=175036
    1530     loadp JSArrayBufferView::m_vector[t0], t3
     1531    loadCaged(JSArrayBufferView::m_vector[t0], t3, t5)
    15311532    biaeq t1, JSArrayBufferView::m_length[t0], .opGetByValSlow
    15321533   
    … …  
    16191620    loadConstantOrVariableInt32(t0, t3, .opPutByValSlow)
    16201621    sxi2q t3, t3
    1621     # FIXME: Should do caging
    1622     # https://bugs.webkit.org/show_bug.cgi?id=175036
    1623     loadp JSObject::m_butterfly[t1], t0
     1622    loadCaged(JSObject::m_butterfly[t1], t0, t5)
    16241623    andi IndexingShapeMask, t2
    16251624    bineq t2, Int32Shape, .opPutByValNotInt32
    … …  
    22392238    loadConstantOrVariable(t1, t2)
    22402239    loadisFromInstruction(6, t1)
    2241     storePropertyAtVariableOffset(t1, t0, t2)
     2240    storePropertyAtVariableOffset(t1, t0, t2, t3)
    22422241end
    22432242

  • trunk/Source/JavaScriptCore/offlineasm/ast.rb

    r220047 r220184  
    929929            $asm.putGlobalAnnotation
    930930        when "emit"
    931           $asm.puts "#{operands[0].dump}"
     931            $asm.puts "#{operands[0].dump}"
    932932        else
    933933            raise "Unhandled opcode #{opcode} at #{codeOriginString}"

  • trunk/Source/JavaScriptCore/offlineasm/x86.rb

    r206759 r220184  
    248248end
    249249
     250class Node
     251    def x86LoadOperand(type, dst)
     252        x86Operand(type)
     253    end
     254end
     255
    250256class RegisterID
    251257    def supports8BitOnX86
    … …  
    457463        asmLabel
    458464    end
     465    def x86LoadOperand(kind, dst)
     466        # FIXME: Implement this on platforms that aren't Mach-O.
     467        # https://bugs.webkit.org/show_bug.cgi?id=175104
     468        $asm.puts "movq #{asmLabel}@GOTPCREL(%rip), #{dst.x86Operand(:ptr)}"
     469        "(#{dst.x86Operand(kind)})"
     470    end
    459471end
    460472
    … …  
    523535        }
    524536        result.join(", ")
     537    end
     538   
     539    def x86LoadOperands(srcKind, dstKind)
     540        orderOperands(operands[0].x86LoadOperand(srcKind, operands[1]), operands[1].x86Operand(dstKind))
    525541    end
    526542
    … …  
    928944        when "xorq"
    929945            handleX86Op("xor#{x86Suffix(:quad)}", :quad)
    930         when "loadi", "storei"
     946        when "loadi"
     947            $asm.puts "mov#{x86Suffix(:int)} #{x86LoadOperands(:int, :int)}"
     948        when "storei"
    931949            $asm.puts "mov#{x86Suffix(:int)} #{x86Operands(:int, :int)}"
    932950        when "loadis"
    933951            if isX64
    934952                if !isIntelSyntax
    935                     $asm.puts "movslq #{x86Operands(:int, :quad)}"
     953                    $asm.puts "movslq #{x86LoadOperands(:int, :quad)}"
    936954                else
    937                     $asm.puts "movsxd #{x86Operands(:int, :quad)}"
     955                    $asm.puts "movsxd #{x86LoadOperands(:int, :quad)}"
    938956                end
    939957            else
    940                 $asm.puts "mov#{x86Suffix(:int)} #{x86Operands(:int, :int)}"
    941             end
    942         when "loadp", "storep"
     958                $asm.puts "mov#{x86Suffix(:int)} #{x86LoadOperands(:int, :int)}"
     959            end
     960        when "loadp"
     961            $asm.puts "mov#{x86Suffix(:ptr)} #{x86LoadOperands(:ptr, :ptr)}"
     962        when "storep"
    943963            $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
    944         when "loadq", "storeq"
     964        when "loadq"
     965            $asm.puts "mov#{x86Suffix(:quad)} #{x86LoadOperands(:quad, :quad)}"
     966        when "storeq"
    945967            $asm.puts "mov#{x86Suffix(:quad)} #{x86Operands(:quad, :quad)}"
    946968        when "loadb"
    947969            if !isIntelSyntax
    948                 $asm.puts "movzbl #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
    949             else
    950                 $asm.puts "movzx #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
     970                $asm.puts "movzbl #{x86LoadOperands(:byte, :int)}"
     971            else
     972                $asm.puts "movzx #{x86LoadOperands(:byte, :int)}"
    951973            end
    952974        when "loadbs"
    953975            if !isIntelSyntax
    954                 $asm.puts "movsbl #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
    955             else
    956                 $asm.puts "movsx #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
     976                $asm.puts "movsbl #{x86LoadOperands(:byte, :int)}"
     977            else
     978                $asm.puts "movsx #{x86LoadOperands(:byte, :int)}"
    957979            end
    958980        when "loadh"
    959981            if !isIntelSyntax
    960                 $asm.puts "movzwl #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
    961             else
    962                 $asm.puts "movzx #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
     982                $asm.puts "movzwl #{x86LoadOperands(:half, :int)}"
     983            else
     984                $asm.puts "movzx #{x86LoadOperands(:half, :int)}"
    963985            end
    964986        when "loadhs"
    965987            if !isIntelSyntax
    966                 $asm.puts "movswl #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
    967             else
    968                 $asm.puts "movsx #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
     988                $asm.puts "movswl #{x86LoadOperands(:half, :int)}"
     989            else
     990                $asm.puts "movsx #{x86LoadOperands(:half, :int)}"
    969991            end
    970992        when "storeb"
Note: See TracChangeset for help on using the changeset viewer.