⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 236534 in webkit


Ignore:
Timestamp:
Sep 26, 2018, 5:14:16 PM (8 years ago)
Author:
mark.lam@apple.com
Message:

Assert that performJITMemcpy() is always called with instruction size aligned addresses on ARM64.
​https://bugs.webkit.org/show_bug.cgi?id=190016
<rdar://problem/44802875>

Reviewed by Saam Barati.

Also assert in performJITMemcpy() that the entire buffer to be copied will fit in
JIT memory.

  • assembler/ARM64Assembler.h:

(JSC::ARM64Assembler::fillNops):
(JSC::ARM64Assembler::replaceWithVMHalt):
(JSC::ARM64Assembler::replaceWithJump):
(JSC::ARM64Assembler::replaceWithLoad):
(JSC::ARM64Assembler::replaceWithAddressComputation):
(JSC::ARM64Assembler::setPointer):
(JSC::ARM64Assembler::repatchInt32):
(JSC::ARM64Assembler::repatchCompact):
(JSC::ARM64Assembler::linkJumpOrCall):
(JSC::ARM64Assembler::linkCompareAndBranch):
(JSC::ARM64Assembler::linkConditionalBranch):
(JSC::ARM64Assembler::linkTestAndBranch):

  • assembler/LinkBuffer.cpp:

(JSC::LinkBuffer::copyCompactAndLinkCode):
(JSC::LinkBuffer::linkCode):

  • jit/ExecutableAllocator.h:

(JSC::performJITMemcpy):

Location:
trunk/Source/JavaScriptCore
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r236520 r236534  
     12018-09-26  Mark Lam  <mark.lam@apple.com>
     2
     3        Assert that performJITMemcpy() is always called with instruction size aligned addresses on ARM64.
     4        https://bugs.webkit.org/show_bug.cgi?id=190016
     5        <rdar://problem/44802875>
     6
     7        Reviewed by Saam Barati.
     8
     9        Also assert in performJITMemcpy() that the entire buffer to be copied will fit in
     10        JIT memory.
     11
     12        * assembler/ARM64Assembler.h:
     13        (JSC::ARM64Assembler::fillNops):
     14        (JSC::ARM64Assembler::replaceWithVMHalt):
     15        (JSC::ARM64Assembler::replaceWithJump):
     16        (JSC::ARM64Assembler::replaceWithLoad):
     17        (JSC::ARM64Assembler::replaceWithAddressComputation):
     18        (JSC::ARM64Assembler::setPointer):
     19        (JSC::ARM64Assembler::repatchInt32):
     20        (JSC::ARM64Assembler::repatchCompact):
     21        (JSC::ARM64Assembler::linkJumpOrCall):
     22        (JSC::ARM64Assembler::linkCompareAndBranch):
     23        (JSC::ARM64Assembler::linkConditionalBranch):
     24        (JSC::ARM64Assembler::linkTestAndBranch):
     25        * assembler/LinkBuffer.cpp:
     26        (JSC::LinkBuffer::copyCompactAndLinkCode):
     27        (JSC::LinkBuffer::linkCode):
     28        * jit/ExecutableAllocator.h:
     29        (JSC::performJITMemcpy):
     30
    1312018-09-25  Keith Miller  <keith_miller@apple.com>
    232

  • trunk/Source/JavaScriptCore/assembler/ARM64Assembler.h

    r236450 r236534  
    267267class ARM64Assembler {
    268268public:
     269    static constexpr size_t instructionSize = sizeof(unsigned);
     270
    269271    typedef ARM64Registers::RegisterID RegisterID;
    270272    typedef ARM64Registers::SPRegisterID SPRegisterID;
    … …  
    15631565        for (int32_t* ptr = static_cast<int32_t*>(base); n--;) {
    15641566            int insn = nopPseudo();
    1565             if (isCopyingToExecutableMemory)
     1567            if (isCopyingToExecutableMemory) {
     1568                RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(ptr) == ptr);
    15661569                performJITMemcpy(ptr++, &insn, sizeof(int));
    1567             else
     1570            } else
    15681571                memcpy(ptr++, &insn, sizeof(int));
    15691572        }
    … …  
    26372640        // This should try to write to null which should always Segfault.
    26382641        int insn = dataCacheZeroVirtualAddress(ARM64Registers::zr);
     2642        RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(where) == where);
    26392643        performJITMemcpy(where, &insn, sizeof(int));
    26402644        cacheFlush(where, sizeof(int));
    … …  
    26462650        ASSERT(static_cast<int>(offset) == offset);
    26472651        int insn = unconditionalBranchImmediate(false, static_cast<int>(offset));
     2652        RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(where) == where);
    26482653        performJITMemcpy(where, &insn, sizeof(int));
    26492654        cacheFlush(where, sizeof(int));
    … …  
    26762681            ASSERT(!(imm12 & ~0xff8));
    26772682            int insn = loadStoreRegisterUnsignedImmediate(MemOpSize_64, false, MemOp_LOAD, encodePositiveImmediate<64>(imm12), rn, rd);
     2683            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(where) == where);
    26782684            performJITMemcpy(where, &insn, sizeof(int));
    26792685            cacheFlush(where, sizeof(int));
    … …  
    27102716            ASSERT(!(imm12 & ~0x1ff));
    27112717            int insn = addSubtractImmediate(Datasize_64, AddOp_ADD, DontSetFlags, 0, imm12 * sizeof(void*), rn, rt);
     2718            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(where) == where);
    27122719            performJITMemcpy(where, &insn, sizeof(int));
    27132720            cacheFlush(where, sizeof(int));
    … …  
    27442751        buffer[1] = moveWideImediate(Datasize_64, MoveWideOp_K, 1, getHalfword(value, 1), rd);
    27452752        buffer[2] = moveWideImediate(Datasize_64, MoveWideOp_K, 2, getHalfword(value, 2), rd);
     2753        RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(address) == address);
    27462754        performJITMemcpy(address, buffer, sizeof(int) * 3);
    27472755
    … …  
    27712779            buffer[1] = moveWideImediate(Datasize_32, MoveWideOp_K, 1, getHalfword(value, 1), rd);
    27722780        }
     2781        RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(where) == where);
    27732782        performJITMemcpy(where, &buffer, sizeof(int) * 2);
    27742783
    … …  
    28462855            imm12 = encodePositiveImmediate<64>(value);
    28472856        int insn = loadStoreRegisterUnsignedImmediate(size, V, opc, imm12, rn, rt);
     2857        RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(where) == where);
    28482858        performJITMemcpy(where, &insn, sizeof(int));
    28492859
    … …  
    30493059
    30503060        int insn = unconditionalBranchImmediate(isCall, static_cast<int>(offset));
     3061        RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from) == from);
    30513062        performJITMemcpy(from, &insn, sizeof(int));
    30523063    }
    … …  
    30653076        if (useDirect || isDirect) {
    30663077            int insn = compareAndBranchImmediate(is64Bit ? Datasize_64 : Datasize_32, condition == ConditionNE, static_cast<int>(offset), rt);
     3078            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from) == from);
    30673079            performJITMemcpy(from, &insn, sizeof(int));
    30683080            if (!isDirect) {
    30693081                insn = nopPseudo();
     3082                RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from + 1) == (from + 1));
    30703083                performJITMemcpy(from + 1, &insn, sizeof(int));
    30713084            }
    30723085        } else {
    30733086            int insn = compareAndBranchImmediate(is64Bit ? Datasize_64 : Datasize_32, invert(condition) == ConditionNE, 2, rt);
     3087            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from) == from);
    30743088            performJITMemcpy(from, &insn, sizeof(int));
    30753089            linkJumpOrCall<false>(from + 1, fromInstruction + 1, to);
    … …  
    30903104        if (useDirect || isDirect) {
    30913105            int insn = conditionalBranchImmediate(static_cast<int>(offset), condition);
     3106            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from) == from);
    30923107            performJITMemcpy(from, &insn, sizeof(int));
    30933108            if (!isDirect) {
    30943109                insn = nopPseudo();
     3110                RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from + 1) == (from + 1));
    30953111                performJITMemcpy(from + 1, &insn, sizeof(int));
    30963112            }
    30973113        } else {
    30983114            int insn = conditionalBranchImmediate(2, invert(condition));
     3115            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from) == from);
    30993116            performJITMemcpy(from, &insn, sizeof(int));
    31003117            linkJumpOrCall<false>(from + 1, fromInstruction + 1, to);
    … …  
    31163133        if (useDirect || isDirect) {
    31173134            int insn = testAndBranchImmediate(condition == ConditionNE, static_cast<int>(bitNumber), static_cast<int>(offset), rt);
     3135            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from) == from);
    31183136            performJITMemcpy(from, &insn, sizeof(int));
    31193137            if (!isDirect) {
    31203138                insn = nopPseudo();
     3139                RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from + 1) == (from + 1));
    31213140                performJITMemcpy(from + 1, &insn, sizeof(int));
    31223141            }
    31233142        } else {
    31243143            int insn = testAndBranchImmediate(invert(condition) == ConditionNE, static_cast<int>(bitNumber), 2, rt);
     3144            RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(from) == from);
    31253145            performJITMemcpy(from, &insn, sizeof(int));
    31263146            linkJumpOrCall<false>(from + 1, fromInstruction + 1, to);

  • trunk/Source/JavaScriptCore/assembler/LinkBuffer.cpp

    r231175 r236534  
    114114    uint8_t* outData = reinterpret_cast<uint8_t*>(outBuffer.buffer());
    115115    uint8_t* codeOutData = m_code.dataLocation<uint8_t*>();
     116#if CPU(ARM64)
     117    RELEASE_ASSERT(roundUpToMultipleOf<sizeof(unsigned)>(outData) == outData);
     118    RELEASE_ASSERT(roundUpToMultipleOf<sizeof(unsigned)>(codeOutData) == codeOutData);
     119#endif
    116120
    117121    int readPtr = 0;
    … …  
    214218#if CPU(ARM_TRADITIONAL)
    215219    macroAssembler.m_assembler.prepareExecutableCopy(code);
     220#elif CPU(ARM64)
     221    RELEASE_ASSERT(roundUpToMultipleOf<Assembler::instructionSize>(code) == code);
    216222#endif
    217223    performJITMemcpy(code, buffer.data(), buffer.codeSize());
    … …  
    336342
    337343#endif // ENABLE(ASSEMBLER)
    338 
    339 

  • trunk/Source/JavaScriptCore/jit/ExecutableAllocator.h

    r236381 r236534  
    8989static inline void* performJITMemcpy(void *dst, const void *src, size_t n)
    9090{
     91#if CPU(ARM64)
     92    static constexpr size_t instructionSize = sizeof(unsigned);
     93    RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(dst) == dst);
     94    RELEASE_ASSERT(roundUpToMultipleOf<instructionSize>(src) == src);
     95#endif
    9196    if (dst >= startOfFixedExecutableMemoryPool() && dst < endOfFixedExecutableMemoryPool()) {
     97        RELEASE_ASSERT(reinterpret_cast<uint8_t*>(dst) + n <= endOfFixedExecutableMemoryPool());
    9298#if ENABLE(FAST_JIT_PERMISSIONS)
    9399        if (useFastPermisionsJITCopy) {
Note: See TracChangeset for help on using the changeset viewer.