Changeset 230273 in webkit


Ignore:
Timestamp:
Apr 4, 2018 1:29:43 PM (6 years ago)
Author:
fpizlo@apple.com
Message:

Remove poisoning of typed array vector
​https://bugs.webkit.org/show_bug.cgi?id=184313

Reviewed by Saam Barati.

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::checkArray):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):

  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):

  • jit/IntrinsicEmitter.cpp:

(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):

  • jit/JITPropertyAccess.cpp:

(JSC::JIT::emitIntTypedArrayGetByVal):
(JSC::JIT::emitFloatTypedArrayGetByVal):
(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter64.asm:
  • offlineasm/arm64.rb:
  • offlineasm/x86.rb:
  • runtime/CagedBarrierPtr.h:
  • runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::JSArrayBufferView):
(JSC::JSArrayBufferView::finalize):
(JSC::JSArrayBufferView::neuter):

  • runtime/JSArrayBufferView.h:

(JSC::JSArrayBufferView::vector const):
(JSC::JSArrayBufferView::offsetOfVector):
(JSC::JSArrayBufferView::offsetOfPoisonedVector): Deleted.
(JSC::JSArrayBufferView::poisonFor): Deleted.
(JSC::JSArrayBufferView::Poison::key): Deleted.

  • runtime/JSCPoison.cpp:

(JSC::initializePoison):

  • runtime/JSCPoison.h:
  • runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
(JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
(JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):

  • runtime/JSObject.h:
Location:
trunk/Source/JavaScriptCore
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r230266 r230273  
     12018-04-04  Filip Pizlo  <fpizlo@apple.com>
     2
     3        Remove poisoning of typed array vector
     4        https://bugs.webkit.org/show_bug.cgi?id=184313
     5
     6        Reviewed by Saam Barati.
     7
     8        * dfg/DFGFixupPhase.cpp:
     9        (JSC::DFG::FixupPhase::checkArray):
     10        * dfg/DFGSpeculativeJIT.cpp:
     11        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
     12        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
     13        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
     14        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
     15        * ftl/FTLAbstractHeapRepository.h:
     16        * ftl/FTLLowerDFGToB3.cpp:
     17        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
     18        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
     19        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
     20        (JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):
     21        * jit/IntrinsicEmitter.cpp:
     22        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
     23        * jit/JITPropertyAccess.cpp:
     24        (JSC::JIT::emitIntTypedArrayGetByVal):
     25        (JSC::JIT::emitFloatTypedArrayGetByVal):
     26        (JSC::JIT::emitIntTypedArrayPutByVal):
     27        (JSC::JIT::emitFloatTypedArrayPutByVal):
     28        * llint/LowLevelInterpreter.asm:
     29        * llint/LowLevelInterpreter64.asm:
     30        * offlineasm/arm64.rb:
     31        * offlineasm/x86.rb:
     32        * runtime/CagedBarrierPtr.h:
     33        * runtime/JSArrayBufferView.cpp:
     34        (JSC::JSArrayBufferView::JSArrayBufferView):
     35        (JSC::JSArrayBufferView::finalize):
     36        (JSC::JSArrayBufferView::neuter):
     37        * runtime/JSArrayBufferView.h:
     38        (JSC::JSArrayBufferView::vector const):
     39        (JSC::JSArrayBufferView::offsetOfVector):
     40        (JSC::JSArrayBufferView::offsetOfPoisonedVector): Deleted.
     41        (JSC::JSArrayBufferView::poisonFor): Deleted.
     42        (JSC::JSArrayBufferView::Poison::key): Deleted.
     43        * runtime/JSCPoison.cpp:
     44        (JSC::initializePoison):
     45        * runtime/JSCPoison.h:
     46        * runtime/JSGenericTypedArrayViewInlines.h:
     47        (JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
     48        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
     49        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
     50        * runtime/JSObject.h:
     51
    1522018-04-03  Filip Pizlo  <fpizlo@apple.com>
    253

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r230144 r230273  
    11/*
    2  * Copyright (C) 2012-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    28882888        }
    28892889       
    2890         ASSERT(arrayMode.type() == Array::String || arrayMode.typedArrayType() != NotTypedArray);
    28912890        return m_insertionSet.insertNode(
    28922891            m_indexInBlock, SpecNone, GetIndexedPropertyStorage, origin,

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r230266 r230273  
    28262826            JITCompiler::Jump hasNullVector = m_jit.branchTestPtr(
    28272827                MacroAssembler::Zero,
    2828                 MacroAssembler::Address(base, JSArrayBufferView::offsetOfPoisonedVector()));
     2828                MacroAssembler::Address(base, JSArrayBufferView::offsetOfVector()));
    28292829            speculationCheck(Uncountable, JSValueSource(), node, hasNullVector);
    28302830            notWasteful.link(&m_jit);
    … …  
    64276427        ASSERT_UNUSED(typedArrayType, isTypedView(typedArrayType));
    64286428
    6429         m_jit.loadPtr(JITCompiler::Address(baseReg, JSArrayBufferView::offsetOfPoisonedVector()), storageReg);
    6430 #if ENABLE(POISON)
    6431         m_jit.xorPtr(JITCompiler::TrustedImmPtr(JSArrayBufferView::poisonFor(typedArrayType)), storageReg);
    6432 #endif
     6429        m_jit.loadPtr(JITCompiler::Address(baseReg, JSArrayBufferView::offsetOfVector()), storageReg);
    64336430        cageTypedArrayStorage(storageReg);
    64346431        break;
    … …  
    64516448    ASSERT(vectorGPR != dataGPR);
    64526449
    6453 #if ENABLE(POISON)
    6454     GPRTemporary poison(this);
    6455     GPRTemporary index(this);
    6456     GPRReg poisonGPR = poison.gpr();
    6457     GPRReg indexGPR = index.gpr();
    6458     GPRReg arrayBufferGPR = poisonGPR;
    6459 #else
    64606450    GPRReg arrayBufferGPR = dataGPR;
    6461 #endif
    64626451
    64636452    JITCompiler::Jump emptyByteOffset = m_jit.branch32(
    … …  
    64666455        TrustedImm32(WastefulTypedArray));
    64676456
    6468     m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfPoisonedVector()), vectorGPR);
     6457    m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), vectorGPR);
    64696458    JITCompiler::Jump nullVector = m_jit.branchTestPtr(JITCompiler::Zero, vectorGPR);
    64706459
    … …  
    64726461    m_jit.cage(Gigacage::JSValue, dataGPR);
    64736462
    6474 #if ENABLE(POISON)
    6475     m_jit.load8(JITCompiler::Address(baseGPR, JSCell::typeInfoTypeOffset()), indexGPR);
    6476     m_jit.move(JITCompiler::TrustedImmPtr(&g_typedArrayPoisons), poisonGPR);
    6477     m_jit.sub32(JITCompiler::TrustedImm32(FirstTypedArrayType), indexGPR);
    6478     m_jit.and32(JITCompiler::TrustedImm32(TypedArrayPoisonIndexMask), indexGPR);
    6479     m_jit.loadPtr(JITCompiler::BaseIndex(poisonGPR, indexGPR, JITCompiler::timesPtr()), poisonGPR);
    6480     m_jit.xorPtr(poisonGPR, vectorGPR);
    6481 #endif
    64826463    cageTypedArrayStorage(vectorGPR);
    64836464
    … …  
    93149295        storageGPR, m_jit.vm()->primitiveGigacageAuxiliarySpace, scratchGPR, scratchGPR,
    93159296        scratchGPR2, slowCases);
    9316 
     9297   
     9298    MacroAssembler::Jump done = m_jit.branchTest32(MacroAssembler::Zero, sizeGPR);
    93179299    m_jit.move(sizeGPR, scratchGPR);
    93189300    if (elementSize(typedArrayType) != 4) {
    … …  
    93329314        MacroAssembler::BaseIndex(storageGPR, scratchGPR, MacroAssembler::TimesFour));
    93339315    m_jit.branchTest32(MacroAssembler::NonZero, scratchGPR).linkTo(loop, &m_jit);
     9316    done.link(&m_jit);
    93349317
    93359318    auto butterfly = TrustedImmPtr(nullptr);
    … …  
    93389321        slowCases);
    93399322
    9340 #if ENABLE(POISON)
    9341     m_jit.move(storageGPR, scratchGPR);
    9342     m_jit.xorPtr(TrustedImmPtr(JSArrayBufferView::poisonFor(typedArrayType)), scratchGPR);
    9343     m_jit.storePtr(
    9344         scratchGPR,
    9345         MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfPoisonedVector()));
    9346 #else
    93479323    m_jit.storePtr(
    93489324        storageGPR,
    9349         MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfPoisonedVector()));
    9350 #endif
     9325        MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfVector()));
    93519326    m_jit.store32(
    93529327        sizeGPR,

  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

    r230266 r230273  
    6161    macro(JSArrayBufferView_length, JSArrayBufferView::offsetOfLength()) \
    6262    macro(JSArrayBufferView_mode, JSArrayBufferView::offsetOfMode()) \
    63     macro(JSArrayBufferView_poisonedVector, JSArrayBufferView::offsetOfPoisonedVector()) \
     63    macro(JSArrayBufferView_vector, JSArrayBufferView::offsetOfVector()) \
    6464    macro(JSCell_cellState, JSCell::cellStateOffset()) \
    6565    macro(JSCell_header, 0) \
    … …  
    150150    macro(HasOwnPropertyCache, 0, sizeof(HasOwnPropertyCache::Entry)) \
    151151    macro(JSFixedArray_buffer, JSFixedArray::offsetOfData(), sizeof(EncodedJSValue)) \
    152     macro(TypedArrayPoisons, 0, sizeof(uintptr_t)) \
    153 
     152   
    154153#define FOR_EACH_NUMBERED_ABSTRACT_HEAP(macro) \
    155154    macro(properties)

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r230266 r230273  
    34963496
    34973497        DFG_ASSERT(m_graph, m_node, isTypedView(m_node->arrayMode().typedArrayType()), m_node->arrayMode().typedArrayType());
    3498         LValue poisonedVector = m_out.loadPtr(cell, m_heaps.JSArrayBufferView_poisonedVector);
    3499 #if ENABLE(POISON)
    3500         auto typedArrayType = m_node->arrayMode().typedArrayType();
    3501         LValue vector = m_out.bitXor(m_out.constIntPtr(JSArrayBufferView::poisonFor(typedArrayType)), poisonedVector);
    3502 #else
    3503         LValue vector = poisonedVector;
    3504 #endif
     3498        LValue vector = m_out.loadPtr(cell, m_heaps.JSArrayBufferView_vector);
    35053499        setStorage(caged(Gigacage::Primitive, vector));
    35063500    }
    … …  
    35413535        m_out.appendTo(wastefulCase, notNull);
    35423536
    3543         LValue poisonedVector = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_poisonedVector);
    3544         ValueFromBlock nullVectorOut = m_out.anchor(poisonedVector);
    3545         m_out.branch(poisonedVector, unsure(notNull), unsure(continuation));
     3537        LValue vector = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);
     3538        ValueFromBlock nullVectorOut = m_out.anchor(vector);
     3539        m_out.branch(vector, unsure(notNull), unsure(continuation));
    35463540
    35473541        m_out.appendTo(notNull, continuation);
    … …  
    35503544        LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);
    35513545
    3552 #if ENABLE(POISON)
    3553         LValue jsType = m_out.load8ZeroExt32(basePtr, m_heaps.JSCell_typeInfoType);
    3554         LValue typeIndex = m_out.sub(jsType, m_out.constInt32(FirstTypedArrayType));
    3555         LValue maskedTypeIndex = m_out.zeroExtPtr(m_out.bitAnd(typeIndex, m_out.constInt32(TypedArrayPoisonIndexMask)));
    3556         LValue poisonsBasePtr = m_out.constIntPtr(&g_typedArrayPoisons);
    3557         LValue poison = m_out.loadPtr(m_out.baseIndex(m_heaps.TypedArrayPoisons, poisonsBasePtr, maskedTypeIndex));
    3558         poisonedVector = m_out.bitXor(poisonedVector, poison);
    3559 #endif
    3560         LValue vectorPtr = caged(Gigacage::Primitive, poisonedVector);
     3546        LValue vectorPtr = caged(Gigacage::Primitive, vector);
    35613547
    35623548        // FIXME: This needs caging.
    … …  
    59265912                allocateObject<JSArrayBufferView>(structure, m_out.intPtrZero, slowCase);
    59275913
    5928 #if ENABLE(POISON)
    5929             storage = m_out.bitXor(m_out.constIntPtr(JSArrayBufferView::poisonFor(typedArrayType)), storage);
    5930 #endif
    5931             m_out.storePtr(storage, fastResultValue, m_heaps.JSArrayBufferView_poisonedVector);
     5914            m_out.storePtr(storage, fastResultValue, m_heaps.JSArrayBufferView_vector);
    59325915            m_out.store32(size, fastResultValue, m_heaps.JSArrayBufferView_length);
    59335916            m_out.store32(m_out.constInt32(FastTypedArray), fastResultValue, m_heaps.JSArrayBufferView_mode);
    … …  
    1542615409
    1542715410        LBasicBlock lastNext = m_out.appendTo(isWasteful, continuation);
    15428         LValue vector = m_out.loadPtr(base, m_heaps.JSArrayBufferView_poisonedVector);
     15411        LValue vector = m_out.loadPtr(base, m_heaps.JSArrayBufferView_vector);
    1542915412        speculate(Uncountable, jsValueValue(vector), m_node, m_out.isZero64(vector));
    1543015413        m_out.jump(continuation);

  • trunk/Source/JavaScriptCore/jit/IntrinsicEmitter.cpp

    r229087 r230273  
    11/*
    2  * Copyright (C) 2015-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    108108        GPRReg scratchGPR = state.scratchGPR;
    109109
    110         CCallHelpers::Jump notEmptyByteOffset = jit.branch32(
    111             MacroAssembler::Equal,
     110        CCallHelpers::Jump emptyByteOffset = jit.branch32(
     111            MacroAssembler::NotEqual,
    112112            MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfMode()),
    113113            TrustedImm32(WastefulTypedArray));
    114114
    115         jit.move(TrustedImmPtr(nullptr), valueGPR);
    116         CCallHelpers::Jump done = jit.jump();
    117 
    118         notEmptyByteOffset.link(&jit);
    119 
    120         // We need to load the butterfly before the vector because baseGPR and valueGPR
    121         // can be the same register.
    122115        jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
    123         jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfPoisonedVector()), valueGPR);
    124         CCallHelpers::Jump nullVector = jit.branchTestPtr(MacroAssembler::Zero, valueGPR);
    125 
    126 #if ENABLE(POISON)
    127         auto typedArrayType = structure()->classInfo()->typedArrayStorageType;
    128         jit.xorPtr(TrustedImmPtr(JSArrayBufferView::poisonFor(typedArrayType)), valueGPR);
    129 #endif
     116        jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), valueGPR);
    130117        jit.loadPtr(MacroAssembler::Address(scratchGPR, Butterfly::offsetOfArrayBuffer()), scratchGPR);
    131118        jit.loadPtr(MacroAssembler::Address(scratchGPR, ArrayBuffer::offsetOfData()), scratchGPR);
    132119        jit.subPtr(scratchGPR, valueGPR);
    133120
    134         nullVector.link(&jit);
     121        CCallHelpers::Jump done = jit.jump();
     122       
     123        emptyByteOffset.link(&jit);
     124        jit.move(TrustedImmPtr(nullptr), valueGPR);
     125       
    135126        done.link(&jit);
    136127       

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r230266 r230273  
    11/*
    2  * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    14611461}
    14621462
    1463 JIT::JumpList JIT::emitIntTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType typeArrayType)
    1464 {
    1465     ASSERT(isInt(typeArrayType));
     1463JIT::JumpList JIT::emitIntTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType type)
     1464{
     1465    ASSERT(isInt(type));
    14661466   
    14671467    // The best way to test the array type is to use the classInfo. We need to do so without
    … …  
    14841484   
    14851485    JumpList slowCases;
    1486     JSType jsType = typeForTypedArrayType(typeArrayType);
    1487 
     1486   
    14881487    load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
    1489     badType = patchableBranch32(NotEqual, scratch, TrustedImm32(jsType));
     1488    badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
    14901489    slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
    1491     loadPtr(Address(base, JSArrayBufferView::offsetOfPoisonedVector()), scratch);
    1492 #if ENABLE(POISON)
    1493     xorPtr(TrustedImmPtr(JSArrayBufferView::poisonFor(jsType)), scratch);
    1494 #endif
     1490    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
    14951491    cageConditionally(Gigacage::Primitive, scratch, scratch2);
    14961492
    1497     switch (elementSize(typeArrayType)) {
     1493    switch (elementSize(type)) {
    14981494    case 1:
    1499         if (JSC::isSigned(typeArrayType))
     1495        if (JSC::isSigned(type))
    15001496            load8SignedExtendTo32(BaseIndex(scratch, property, TimesOne), resultPayload);
    15011497        else
    … …  
    15031499        break;
    15041500    case 2:
    1505         if (JSC::isSigned(typeArrayType))
     1501        if (JSC::isSigned(type))
    15061502            load16SignedExtendTo32(BaseIndex(scratch, property, TimesTwo), resultPayload);
    15071503        else
    … …  
    15161512   
    15171513    Jump done;
    1518     if (typeArrayType == TypeUint32) {
     1514    if (type == TypeUint32) {
    15191515        Jump canBeInt = branch32(GreaterThanOrEqual, resultPayload, TrustedImm32(0));
    15201516       
    … …  
    15421538}
    15431539
    1544 JIT::JumpList JIT::emitFloatTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType typeArrayType)
    1545 {
    1546     ASSERT(isFloat(typeArrayType));
     1540JIT::JumpList JIT::emitFloatTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType type)
     1541{
     1542    ASSERT(isFloat(type));
    15471543   
    15481544#if USE(JSVALUE64)
    … …  
    15621558   
    15631559    JumpList slowCases;
    1564     JSType jsType = typeForTypedArrayType(typeArrayType);
    15651560
    15661561    load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
    1567     badType = patchableBranch32(NotEqual, scratch, TrustedImm32(jsType));
     1562    badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
    15681563    slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
    1569     loadPtr(Address(base, JSArrayBufferView::offsetOfPoisonedVector()), scratch);
    1570 #if ENABLE(POISON)
    1571     xorPtr(TrustedImmPtr(JSArrayBufferView::poisonFor(jsType)), scratch);
    1572 #endif
     1564    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
    15731565    cageConditionally(Gigacage::Primitive, scratch, scratch2);
    15741566   
    1575     switch (elementSize(typeArrayType)) {
     1567    switch (elementSize(type)) {
    15761568    case 4:
    15771569        loadFloat(BaseIndex(scratch, property, TimesFour), fpRegT0);
    … …  
    16001592}
    16011593
    1602 JIT::JumpList JIT::emitIntTypedArrayPutByVal(Instruction* currentInstruction, PatchableJump& badType, TypedArrayType typeArrayType)
     1594JIT::JumpList JIT::emitIntTypedArrayPutByVal(Instruction* currentInstruction, PatchableJump& badType, TypedArrayType type)
    16031595{
    16041596    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    1605     ASSERT(isInt(typeArrayType));
     1597    ASSERT(isInt(type));
    16061598   
    16071599    int value = currentInstruction[3].u.operand;
    … …  
    16221614   
    16231615    JumpList slowCases;
    1624     JSType jsType = typeForTypedArrayType(typeArrayType);
    1625 
     1616   
    16261617    load8(Address(base, JSCell::typeInfoTypeOffset()), earlyScratch);
    1627     badType = patchableBranch32(NotEqual, earlyScratch, TrustedImm32(jsType));
     1618    badType = patchableBranch32(NotEqual, earlyScratch, TrustedImm32(typeForTypedArrayType(type)));
    16281619    Jump inBounds = branch32(Below, property, Address(base, JSArrayBufferView::offsetOfLength()));
    16291620    emitArrayProfileOutOfBoundsSpecialCase(profile);
    … …  
    16411632    // We would be loading this into base as in get_by_val, except that the slow
    16421633    // path expects the base to be unclobbered.
    1643     loadPtr(Address(base, JSArrayBufferView::offsetOfPoisonedVector()), lateScratch);
    1644 #if ENABLE(POISON)
    1645     xorPtr(TrustedImmPtr(JSArrayBufferView::poisonFor(jsType)), lateScratch);
    1646 #endif
     1634    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
    16471635    cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2);
    16481636   
    1649     if (isClamped(typeArrayType)) {
    1650         ASSERT(elementSize(typeArrayType) == 1);
    1651         ASSERT(!JSC::isSigned(typeArrayType));
     1637    if (isClamped(type)) {
     1638        ASSERT(elementSize(type) == 1);
     1639        ASSERT(!JSC::isSigned(type));
    16521640        Jump inBounds = branch32(BelowOrEqual, earlyScratch, TrustedImm32(0xff));
    16531641        Jump tooBig = branch32(GreaterThan, earlyScratch, TrustedImm32(0xff));
    … …  
    16601648    }
    16611649   
    1662     switch (elementSize(typeArrayType)) {
     1650    switch (elementSize(type)) {
    16631651    case 1:
    16641652        store8(earlyScratch, BaseIndex(lateScratch, property, TimesOne));
    … …  
    16771665}
    16781666
    1679 JIT::JumpList JIT::emitFloatTypedArrayPutByVal(Instruction* currentInstruction, PatchableJump& badType, TypedArrayType typeArrayType)
     1667JIT::JumpList JIT::emitFloatTypedArrayPutByVal(Instruction* currentInstruction, PatchableJump& badType, TypedArrayType type)
    16801668{
    16811669    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    1682     ASSERT(isFloat(typeArrayType));
     1670    ASSERT(isFloat(type));
    16831671   
    16841672    int value = currentInstruction[3].u.operand;
    … …  
    16991687   
    17001688    JumpList slowCases;
    1701     JSType jsType = typeForTypedArrayType(typeArrayType);
    1702 
     1689   
    17031690    load8(Address(base, JSCell::typeInfoTypeOffset()), earlyScratch);
    1704     badType = patchableBranch32(NotEqual, earlyScratch, TrustedImm32(jsType));
     1691    badType = patchableBranch32(NotEqual, earlyScratch, TrustedImm32(typeForTypedArrayType(type)));
    17051692    Jump inBounds = branch32(Below, property, Address(base, JSArrayBufferView::offsetOfLength()));
    17061693    emitArrayProfileOutOfBoundsSpecialCase(profile);
    … …  
    17311718    // We would be loading this into base as in get_by_val, except that the slow
    17321719    // path expects the base to be unclobbered.
    1733     loadPtr(Address(base, JSArrayBufferView::offsetOfPoisonedVector()), lateScratch);
    1734 #if ENABLE(POISON)
    1735     xorPtr(TrustedImmPtr(JSArrayBufferView::poisonFor(jsType)), lateScratch);
    1736 #endif
     1720    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
    17371721    cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2);
    17381722   
    1739     switch (elementSize(typeArrayType)) {
     1723    switch (elementSize(type)) {
    17401724    case 4:
    17411725        convertDoubleToFloat(fpRegT0, fpRegT0);

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r230266 r230273  
    404404const FirstTypedArrayType = constexpr FirstTypedArrayType
    405405const NumberOfTypedArrayTypesExcludingDataView = constexpr NumberOfTypedArrayTypesExcludingDataView
    406 const TypedArrayPoisonIndexMask = constexpr TypedArrayPoisonIndexMask
    407406
    408407# Type flags constants.

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r230266 r230273  
    392392end
    393393
    394 macro loadTypedArrayCaged(basePtr, mask, source, typeIndex, dest, scratch)
    395     if POISON
    396         leap _g_typedArrayPoisons, dest
    397         loadp (typeIndex - FirstTypedArrayType) * 8[dest], dest
    398         loadp source, scratch
    399         xorp scratch, dest
    400     else
    401         loadp source, dest
    402     end
    403     uncage(basePtr, mask, dest, scratch)
    404 end
    405 
    406394macro loadVariable(operand, value)
    407395    loadisFromInstruction(operand, value)
    … …  
    16371625
    16381626    # We have Int8ArrayType.
    1639     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Int8ArrayType, t3, t2)
     1627    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16401628    loadbs [t3, t1], t0
    16411629    finishIntGetByVal(t0, t1)
    … …  
    16451633
    16461634    # We have Uint8ArrayType.
    1647     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Uint8ArrayType, t3, t2)
     1635    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16481636    loadb [t3, t1], t0
    16491637    finishIntGetByVal(t0, t1)
    … …  
    16511639.opGetByValUint8ClampedArray:
    16521640    # We have Uint8ClampedArrayType.
    1653     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Uint8ClampedArrayType, t3, t2)
     1641    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16541642    loadb [t3, t1], t0
    16551643    finishIntGetByVal(t0, t1)
    … …  
    16601648
    16611649    # We have Int16ArrayType.
    1662     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Int16ArrayType, t3, t2)
     1650    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16631651    loadhs [t3, t1, 2], t0
    16641652    finishIntGetByVal(t0, t1)
    … …  
    16661654.opGetByValUint16Array:
    16671655    # We have Uint16ArrayType.
    1668     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Uint16ArrayType, t3, t2)
     1656    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16691657    loadh [t3, t1, 2], t0
    16701658    finishIntGetByVal(t0, t1)
    … …  
    16781666
    16791667    # We have Int32ArrayType.
    1680     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Int32ArrayType, t3, t2)
     1668    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16811669    loadi [t3, t1, 4], t0
    16821670    finishIntGetByVal(t0, t1)
    … …  
    16841672.opGetByValUint32Array:
    16851673    # We have Uint32ArrayType.
    1686     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Uint32ArrayType, t3, t2)
     1674    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16871675    # This is the hardest part because of large unsigned values.
    16881676    loadi [t3, t1, 4], t0
    … …  
    16961684
    16971685    # We have Float64ArrayType.
    1698     loadTypedArrayCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_poisonedVector[t0], Float64ArrayType, t3, t2)
     1686    loadCaged(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr PRIMITIVE_GIGACAGE_MASK, JSArrayBufferView::m_vector[t0], t3, t2)
    16991687    loadd [t3, t1, 8], ft0
    17001688    bdnequn ft0, ft0, .opGetByValSlow

  • trunk/Source/JavaScriptCore/offlineasm/arm64.rb

    r228402 r230273  
    273273                    newList << Instruction.new(codeOrigin, "globaladdr", [LabelReference.new(node.codeOrigin, labelRef.label), tmp])
    274274                    newList << Instruction.new(codeOrigin, node.opcode, [Address.new(node.codeOrigin, tmp, Immediate.new(node.codeOrigin, labelRef.offset)), node.operands[1]])
    275                 else
    276                     newList << node
    277                 end
    278             when "leai", "leap", "leaq"
    279                 labelRef = node.operands[0]
    280                 if labelRef.is_a? LabelReference
    281                     newList << Instruction.new(codeOrigin, "globaladdr", [LabelReference.new(node.codeOrigin, labelRef.label), node.operands[1]])
    282275                else
    283276                    newList << node

  • trunk/Source/JavaScriptCore/offlineasm/x86.rb

    r229912 r230273  
    468468        $asm.puts "movq #{asmLabel}@GOTPCREL(%rip), #{dst.x86Operand(:ptr)}"
    469469        "#{offset}(#{dst.x86Operand(kind)})"
    470     end
    471     def x86AddressOperand(addressKind)
    472         # FIXME: Implement this on platforms that aren't Mach-O.
    473         # https://bugs.webkit.org/show_bug.cgi?id=175104
    474         "#{asmLabel}@GOTPCREL(%rip)"
    475470    end
    476471end
    … …  
    15521547            $asm.puts "jnz #{operands[0].asmLabel}"
    15531548        when "leai"
    1554             emitX86Lea(operands[0], operands[1], :int)
     1549            $asm.puts "lea#{x86Suffix(:int)} #{orderOperands(operands[0].x86AddressOperand(:int), operands[1].x86Operand(:int))}"
    15551550        when "leap"
    1556             emitX86Lea(operands[0], operands[1], :ptr)
     1551            $asm.puts "lea#{x86Suffix(:ptr)} #{orderOperands(operands[0].x86AddressOperand(:ptr), operands[1].x86Operand(:ptr))}"
    15571552        when "memfence"
    15581553            sp = RegisterID.new(nil, "sp")

  • trunk/Source/JavaScriptCore/runtime/CagedBarrierPtr.h

    r227874 r230273  
    11/*
    2  * Copyright (C) 2017-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2727
    2828#include "AuxiliaryBarrier.h"
    29 #include <type_traits>
    3029#include <wtf/CagedPtr.h>
    31 
    32 namespace WTF {
    33 
    34 template<typename Poison, typename T> struct PoisonedPtrTraits;
    35 
    36 } // namespace WTF
    3730
    3831namespace JSC {
    … …  
    4336// This is a convenient combo of AuxiliaryBarrier and CagedPtr.
    4437
    45 template<Gigacage::Kind passedKind, typename T, typename PtrTraits = WTF::DumbPtrTraits<T>>
     38template<Gigacage::Kind passedKind, typename T>
    4639class CagedBarrierPtr {
    4740public:
    … …  
    9386   
    9487private:
    95     AuxiliaryBarrier<CagedPtr<kind, T, PtrTraits>> m_barrier;
     88    AuxiliaryBarrier<CagedPtr<kind, T>> m_barrier;
    9689};
    9790
    98 template<Gigacage::Kind passedKind, typename PtrTraits>
    99 class CagedBarrierPtr<passedKind, void, PtrTraits> {
     91template<Gigacage::Kind passedKind>
     92class CagedBarrierPtr<passedKind, void> {
    10093public:
    10194    static constexpr Gigacage::Kind kind = passedKind;
    … …  
    140133   
    141134private:
    142     AuxiliaryBarrier<CagedPtr<kind, void, PtrTraits>> m_barrier;
     135    AuxiliaryBarrier<CagedPtr<kind, void>> m_barrier;
    143136};
    144137
    145 template<typename Poison, Gigacage::Kind passedKind, typename T>
    146 using PoisonedCagedBarrierPtr = CagedBarrierPtr<passedKind, T, WTF::PoisonedPtrTraits<Poison, T>>;
    147 
    148138} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp

    r230144 r230273  
    11/*
    2  * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    133133{
    134134    setButterfly(vm, context.butterfly());
    135     m_poisonedVector.setWithoutBarrier(context.vector());
     135    m_vector.setWithoutBarrier(context.vector());
    136136}
    137137
    … …  
    195195    ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray);
    196196    if (thisObject->m_mode == OversizeTypedArray)
    197         Gigacage::free(Gigacage::Primitive, thisObject->m_poisonedVector.get());
     197        Gigacage::free(Gigacage::Primitive, thisObject->m_vector.get());
    198198}
    199199
    … …  
    213213    RELEASE_ASSERT(!isShared());
    214214    m_length = 0;
    215     m_poisonedVector.clear();
     215    m_vector.clear();
    216216}
    217217

  • trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h

    r227874 r230273  
    11/*
    2  * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2727
    2828#include "AuxiliaryBarrier.h"
    29 #include "CagedBarrierPtr.h"
    30 #include "JSCPoison.h"
    3129#include "JSObject.h"
    32 #include "TypedArrayType.h"
    33 #include <wtf/MathExtras.h>
    3430
    3531namespace JSC {
    3632
    3733class LLIntOffsetsExtractor;
    38 
    39 // Since we'll be indexing into the g_typedArrayPoisons array based on the TypedArray type,
    40 // we'll index mask the index value and round up to the array size to the next power of 2 to
    41 // ensure that we'll never be able to access beyond the bounds of this array.
    42 static constexpr uint32_t NumberOfTypedArrayPoisons = WTF::roundUpToPowerOfTwo(NumberOfTypedArrayTypes);
    43 static constexpr uint32_t TypedArrayPoisonIndexMask = NumberOfTypedArrayPoisons - 1;
    4434
    4535// This class serves two purposes:
    … …  
    178168    void neuter();
    179169   
    180     void* vector() const { return m_poisonedVector.getMayBeNull(); }
     170    void* vector() const { return m_vector.getMayBeNull(); }
    181171   
    182172    unsigned byteOffset();
    … …  
    185175    DECLARE_EXPORT_INFO;
    186176   
    187     static ptrdiff_t offsetOfPoisonedVector() { return OBJECT_OFFSETOF(JSArrayBufferView, m_poisonedVector); }
     177    static ptrdiff_t offsetOfVector() { return OBJECT_OFFSETOF(JSArrayBufferView, m_vector); }
    188178    static ptrdiff_t offsetOfLength() { return OBJECT_OFFSETOF(JSArrayBufferView, m_length); }
    189179    static ptrdiff_t offsetOfMode() { return OBJECT_OFFSETOF(JSArrayBufferView, m_mode); }
    … …  
    191181    static RefPtr<ArrayBufferView> toWrapped(VM&, JSValue);
    192182
    193     static uintptr_t poisonFor(JSType type)
    194     {
    195         return g_typedArrayPoisons[(type - FirstTypedArrayType) & TypedArrayPoisonIndexMask];
    196     }
    197 
    198     static uintptr_t poisonFor(TypedArrayType typedArrayType)
    199     {
    200         ASSERT(isTypedView(typedArrayType));
    201         return poisonFor(typeForTypedArrayType(typedArrayType));
    202     }
    203 
    204183private:
    205184    static void finalize(JSCell*);
    … …  
    212191    static String toStringName(const JSObject*, ExecState*);
    213192
    214     class Poison {
    215     public:
    216         template<typename PoisonedType>
    217         inline static uintptr_t key(const PoisonedType* poisonedPtr)
    218         {
    219             uintptr_t poisonedVectorAddress = bitwise_cast<uintptr_t>(poisonedPtr);
    220             uintptr_t baseAddress = poisonedVectorAddress - OBJECT_OFFSETOF(JSArrayBufferView, m_poisonedVector);
    221             JSArrayBufferView* thisObject = bitwise_cast<JSArrayBufferView*>(baseAddress);
    222             return poisonFor(thisObject->type());
    223         }
    224     };
    225 
    226     PoisonedCagedBarrierPtr<Poison, Gigacage::Primitive, void> m_poisonedVector;
     193    CagedBarrierPtr<Gigacage::Primitive, void> m_vector;
    227194    uint32_t m_length;
    228195    TypedArrayMode m_mode;

  • trunk/Source/JavaScriptCore/runtime/JSCPoison.cpp

    r227874 r230273  
    2727#include "JSCPoison.h"
    2828
    29 #include "JSArrayBufferView.h"
    3029#include "Options.h"
    3130#include <mutex>
    … …  
    3736    uintptr_t POISON_KEY_NAME(poisonID);
    3837FOR_EACH_JSC_POISON(DEFINE_POISON)
    39 
    40 uintptr_t g_typedArrayPoisons[NumberOfTypedArrayPoisons];
    4138
    4239void initializePoison()
    … …  
    5148
    5249        FOR_EACH_JSC_POISON(INITIALIZE_POISON)
    53 
    54         for (uint32_t i = 0; i < NumberOfTypedArrayPoisons; ++i)
    55             g_typedArrayPoisons[i] = makePoison();
    5650    });
    5751}

  • trunk/Source/JavaScriptCore/runtime/JSCPoison.h

    r230266 r230273  
    6767#undef DECLARE_POISON
    6868
    69 extern "C" JS_EXPORT_PRIVATE uintptr_t g_typedArrayPoisons[];
    70 
    7169struct ClassInfo;
    7270

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h

    r230144 r230273  
    11/*
    2  * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    505505    if (thisObject->m_mode == OversizeTypedArray)
    506506        return Base::estimatedSize(thisObject) + thisObject->byteSize();
    507     if (thisObject->m_mode == FastTypedArray && thisObject->m_poisonedVector)
     507    if (thisObject->m_mode == FastTypedArray && thisObject->m_vector)
    508508        return Base::estimatedSize(thisObject) + thisObject->byteSize();
    509509
    … …  
    518518    switch (thisObject->m_mode) {
    519519    case FastTypedArray: {
    520         if (void* vector = thisObject->m_poisonedVector.getMayBeNull())
     520        if (void* vector = thisObject->m_vector.getMayBeNull())
    521521            visitor.markAuxiliary(vector);
    522522        break;
    … …  
    585585
    586586    thisObject->butterfly()->indexingHeader()->setArrayBuffer(buffer.get());
    587     thisObject->m_poisonedVector.setWithoutBarrier(buffer->data());
     587    thisObject->m_vector.setWithoutBarrier(buffer->data());
    588588    WTF::storeStoreFence();
    589589    thisObject->m_mode = WastefulTypedArray;

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r230144 r230273  
    2525#include "ArrayConventions.h"
    2626#include "ArrayStorage.h"
    27 #include "AuxiliaryBarrier.h"
    2827#include "Butterfly.h"
    2928#include "CPU.h"
     29#include "CagedBarrierPtr.h"
    3030#include "CallFrame.h"
    3131#include "ClassInfo.h"
Note: See TracChangeset for help on using the changeset viewer.