Changeset 271422 in webkit

Timestamp:

Jan 12, 2021, 4:09:16 PM (6 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Bypass OperationPtrTagging for JITCage verification for CallDOMGetter
​https://bugs.webkit.org/show_bug.cgi?id=220564

Reviewed by Saam Barati.

JSTests:

• stress/domjit-getter2.js: Added.

(shouldBe):
(access):

Source/JavaScriptCore:

CustomAccessorPtrTag functions are not registered ones for JITCage since we are using C++ trampoline to invoke them.
However, we do not want to use this trampoline in x64 due to performance issue. So we would like to call these
functions directly from JIT while they are not registered (And this is OK in JITCage since they are called from trampoline).
In this patch we bypass OperationPtrTagging by using WTF::tagNativeCodePtrImpl directly for non JITCage case.

• dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::appendOperationCall):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::appendOperationCall):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
(JSC::FTL::DFG::LowerDFGToB3::vmCall):

• ftl/FTLOutput.h:

(JSC::FTL::Output::operation):

• tools/JSDollarVM.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/domjit-getter2.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGJITCompiler.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (2 diffs)
• Source/JavaScriptCore/ftl/FTLOutput.h (modified) (1 diff)
• Source/JavaScriptCore/tools/JSDollarVM.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-01-12  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Bypass OperationPtrTagging for JITCage verification for CallDOMGetter
+        https://bugs.webkit.org/show_bug.cgi?id=220564
+
+        Reviewed by Saam Barati.
+
+        * stress/domjit-getter2.js: Added.
+        (shouldBe):
+        (access):
+
 2021-01-12  Caio Lima  <ticaiolima@gmail.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-01-12  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Bypass OperationPtrTagging for JITCage verification for CallDOMGetter
+        https://bugs.webkit.org/show_bug.cgi?id=220564
+
+        Reviewed by Saam Barati.
+
+        CustomAccessorPtrTag functions are not registered ones for JITCage since we are using C++ trampoline to invoke them.
+        However, we do not want to use this trampoline in x64 due to performance issue. So we would like to call these
+        functions directly from JIT while they are not registered (And this is OK in JITCage since they are called from trampoline).
+        In this patch we bypass OperationPtrTagging by using WTF::tagNativeCodePtrImpl directly for non JITCage case.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::appendOperationCall):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendOperationCall):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
+        (JSC::FTL::DFG::LowerDFGToB3::vmCall):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::operation):
+        * tools/JSDollarVM.cpp:
+
 2021-01-12  Caio Lima  <ticaiolima@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h

@@ -146 +146 @@
         return functionCall;
     }
+
+    Call appendOperationCall(const FunctionPtr<OperationPtrTag> function)
+    {
+        Call functionCall = call(OperationPtrTag);
+        m_calls.append(CallLinkRecord(functionCall, function));
+        return functionCall;
+    }
     
     void exceptionCheck();

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -10123 +10123 @@
         if (Options::useJITCage())
             m_jit.appendCall(vmEntryCustomAccessor);
-        else
-            m_jit.appendCall(getter.retagged<CFunctionPtrTag>());
+        else {
+            FunctionPtr<OperationPtrTag> bypassedFunction = FunctionPtr<OperationPtrTag>(MacroAssemblerCodePtr<OperationPtrTag>(WTF::tagNativeCodePtrImpl<OperationPtrTag>(WTF::untagNativeCodePtrImpl<CustomAccessorPtrTag>(getter.executableAddress()))));
+            m_jit.appendOperationCall(bypassedFunction);
+        }
         m_jit.setupResults(resultRegs);
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -985 +985 @@
         m_jit.emitStoreCodeOrigin(m_currentNode->origin.semantic);
         return m_jit.appendCall(function);
+    }
+
+    JITCompiler::Call appendOperationCall(const FunctionPtr<OperationPtrTag> function)
+    {
+        prepareForExternalCall();
+        m_jit.emitStoreCodeOrigin(m_currentNode->origin.semantic);
+        return m_jit.appendOperationCall(function);
     }
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -14507 +14507 @@
                     vmCall(Int64, vmEntryCustomAccessor, weakPointer(globalObject), lowCell(m_node->child1()), m_out.constIntPtr(m_graph.identifiers()[m_node->callDOMGetterData()->identifierNumber]), m_out.constIntPtr(m_node->callDOMGetterData()->customAccessorGetter.executableAddress())));
             } else {
-                setJSValue(
-                    vmCall(Int64, bitwise_cast<CustomGetterSetter::CustomGetter>(m_node->callDOMGetterData()->customAccessorGetter.retaggedExecutableAddress<CFunctionPtrTag>()),
-                        weakPointer(globalObject), lowCell(m_node->child1()), m_out.constIntPtr(m_graph.identifiers()[m_node->callDOMGetterData()->identifierNumber])));
+                FunctionPtr<CustomAccessorPtrTag> getter = m_node->callDOMGetterData()->customAccessorGetter;
+                FunctionPtr<OperationPtrTag> bypassedFunction = FunctionPtr<OperationPtrTag>(MacroAssemblerCodePtr<OperationPtrTag>(WTF::tagNativeCodePtrImpl<OperationPtrTag>(WTF::untagNativeCodePtrImpl<CustomAccessorPtrTag>(getter.executableAddress()))));
+                setJSValue(vmCall(Int64, bypassedFunction, weakPointer(globalObject), lowCell(m_node->child1()), m_out.constIntPtr(m_graph.identifiers()[m_node->callDOMGetterData()->identifierNumber])));
             }
             return;
@@ -19104 +19104 @@
     {
         static_assert(!std::is_same<OperationType, LValue>::value);
-        static_assert(FunctionTraits<OperationType>::cCallArity() == sizeof...(Args), "Sanity check");
+        if constexpr (!std::is_same_v<FunctionPtr<OperationPtrTag>, OperationType>)
+            static_assert(FunctionTraits<OperationType>::cCallArity() == sizeof...(Args), "Sanity check");
         callPreflight();
         LValue result = m_out.call(type, m_out.operation(function), std::forward<Args>(args)...);

trunk/Source/JavaScriptCore/ftl/FTLOutput.h

@@ -403 +403 @@
     template<typename FunctionType>
     LValue operation(FunctionType function) { return constIntPtr(tagCFunctionPtr<void*, OperationPtrTag>(function)); }
+    LValue operation(FunctionPtr<OperationPtrTag> function) { return constIntPtr(function.executableAddress()); }
 
     void jump(LBasicBlock);

trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp

@@ -988 +988 @@
     DollarVMAssertScope assertScope;
     Base::finishCreation(vm);
-    const DOMJIT::GetterSetter* domJIT = &DOMJITGetterDOMJIT;
-    auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, domJIT->getter(), nullptr, DOMAttributeAnnotation { DOMJITNode::info(), domJIT });
-    putDirectCustomAccessor(vm, Identifier::fromString(vm, "customGetter"), customGetterSetter, PropertyAttribute::ReadOnly | PropertyAttribute::CustomAccessor);
+    {
+        const DOMJIT::GetterSetter* domJIT = &DOMJITGetterDOMJIT;
+        auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, domJIT->getter(), nullptr, DOMAttributeAnnotation { DOMJITNode::info(), domJIT });
+        putDirectCustomAccessor(vm, Identifier::fromString(vm, "customGetter"), customGetterSetter, PropertyAttribute::ReadOnly | PropertyAttribute::CustomAccessor);
+    }
+    {
+        auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, domJITGetterCustomGetter, nullptr, DOMAttributeAnnotation { DOMJITNode::info(), nullptr });
+        putDirectCustomAccessor(vm, Identifier::fromString(vm, "customGetter2"), customGetterSetter, PropertyAttribute::ReadOnly | PropertyAttribute::CustomAccessor);
+    }
 }