Changeset 220628 in webkit

Timestamp:

Aug 12, 2017 6:59:16 PM (7 years ago)

Author:

fpizlo@apple.com

Message:

FTL's compileGetTypedArrayByteOffset needs to do caging
​https://bugs.webkit.org/show_bug.cgi?id=175366

Reviewed by Saam Barati.

While implementing boxing in the DFG, I noticed that there was some missing boxing in the FTL. This
fixes the case in GetTypedArrayByteOffset, and files FIXMEs for more such cases.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::cagedMayBeNull):

• runtime/ArrayBuffer.h:
• runtime/ArrayBufferView.h:
• runtime/JSArrayBufferView.h:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• ftl/FTLLowerDFGToB3.cpp (modified) (2 diffs)
• runtime/ArrayBuffer.h (modified) (2 diffs)
• runtime/ArrayBufferView.h (modified) (1 diff)
• runtime/JSArrayBufferView.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-08-12  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL's compileGetTypedArrayByteOffset needs to do caging
+        https://bugs.webkit.org/show_bug.cgi?id=175366
+
+        Reviewed by Saam Barati.
+        
+        While implementing boxing in the DFG, I noticed that there was some missing boxing in the FTL. This
+        fixes the case in GetTypedArrayByteOffset, and files FIXMEs for more such cases.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::cagedMayBeNull):
+        * runtime/ArrayBuffer.h:
+        * runtime/ArrayBufferView.h:
+        * runtime/JSArrayBufferView.h:
+
 2017-08-11  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -6199 +6199 @@
     nullVector.link(&m_jit);
     m_jit.loadPtr(MacroAssembler::Address(dataGPR, Butterfly::offsetOfArrayBuffer()), dataGPR);
+    // FIXME: This needs caging.
+    // https://bugs.webkit.org/show_bug.cgi?id=175515
     m_jit.loadPtr(MacroAssembler::Address(dataGPR, ArrayBuffer::offsetOfData()), dataGPR);
     m_jit.subPtr(dataGPR, vectorGPR);

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -3310 +3310 @@
         m_out.appendTo(wastefulCase, continuation);
 
-        // FIXME: This needs to do caging.
-        // https://bugs.webkit.org/show_bug.cgi?id=175366
-        LValue vectorPtr = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);
-        LValue butterflyPtr = m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly);
+        LValue vectorPtr = cagedMayBeNull(
+            Gigacage::Primitive,
+            m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector));
+        LValue butterflyPtr = caged(Gigacage::JSValue, m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly));
         LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);
+        // FIXME: This needs caging.
+        // https://bugs.webkit.org/show_bug.cgi?id=175515
         LValue dataPtr = m_out.loadPtr(arrayBufferPtr, m_heaps.ArrayBuffer_data);
 
@@ -11642 +11644 @@
         // https://bugs.webkit.org/show_bug.cgi?id=175493
         return m_out.opaque(result);
+    }
+    
+    LValue cagedMayBeNull(Gigacage::Kind kind, LValue ptr)
+    {
+        LBasicBlock notNull = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(notNull);
+        
+        ValueFromBlock nullResult = m_out.anchor(ptr);
+        m_out.branch(ptr, unsure(notNull), unsure(continuation));
+        
+        m_out.appendTo(notNull, continuation);
+        ValueFromBlock notNullResult = m_out.anchor(caged(kind, ptr));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(pointerType(), nullResult, notNullResult);
     }
     

trunk/Source/JavaScriptCore/runtime/ArrayBuffer.h

@@ -51 +51 @@
     
 private:
+    // FIXME: This should be CagedPtr<>.
+    // https://bugs.webkit.org/show_bug.cgi?id=175515
     void* m_data;
     ArrayBufferDestructorFunction m_destructor;
@@ -96 +98 @@
     ArrayBufferDestructorFunction m_destructor;
     RefPtr<SharedArrayBufferContents> m_shared;
+    // FIXME: This should be CagedPtr<>.
+    // https://bugs.webkit.org/show_bug.cgi?id=175515
     void* m_data;
     unsigned m_sizeInBytes;

trunk/Source/JavaScriptCore/runtime/ArrayBufferView.h

@@ -148 +148 @@
 
     // This is the address of the ArrayBuffer's storage, plus the byte offset.
+    // FIXME: This should be CagedPtr<>.
+    // https://bugs.webkit.org/show_bug.cgi?id=175515
     void* m_baseAddress;
 

trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h

@@ -141 +141 @@
     private:
         Structure* m_structure;
+        // FIXME: This should be CagedPtr<>.
+        // https://bugs.webkit.org/show_bug.cgi?id=175515
         void* m_vector;
         uint32_t m_length;
@@ -191 +193 @@
     static String toStringName(const JSObject*, ExecState*);
 
+    // FIXME: This should be CagedBarrierPtr<>.
+    // https://bugs.webkit.org/show_bug.cgi?id=175515
     AuxiliaryBarrier<void*> m_vector;
     uint32_t m_length;