Changeset 262475 in webkit


Ignore:
Timestamp:
Jun 2, 2020, 9:47:30 PM (5 years ago)
Author:
mark.lam@apple.com
Message:

Enhance DoesGC verification to print more useful info when verification fails.
​https://bugs.webkit.org/show_bug.cgi?id=212680

Reviewed by Yusuke Suzuki.

When DoesGC verification fails, the first step of debugging it would be to find
out what and which DFG node resulted in the failed verification. In pre-existing
code, all we get is an assertion failure.

This patch makes it so that the verifier will dump useful info. Here's an example:

Error: DoesGC failed @ D@34 DateGetInt32OrNaN in #DtCHMz:[0x1135bd1d0->0x1135bcab0->0x1135e5c80, DFGFunctionCall, 150 (DidTryToEnterInLoop)]

[0] frame 0x7ffee8285660 {

name:
sourceURL:
isInlinedFrame: false
callee: 0x1135f6820
returnPC: 0x50ce61248ae6
callerFrame: 0x7ffee82856f0
rawLocationBits: 5 0x5
codeBlock: 0x1135bd1d0 #DtCHMz:[0x1135bd1d0->0x1135bcab0->0x1135e5c80, DFGFunctionCall, 150 (DidTryToEnterInLoop)]

hasCodeOrigins: true
callSiteIndex: 5 of 13
jitCode: 0x113020200 start 0x50ce61214c60 end 0x50ce61219b00
line: 1
column: 60

EntryFrame: 0x7ffee8285860

}
[1] frame 0x7ffee82856f0 {

name:
sourceURL: date-format-xparb.js
isInlinedFrame: false
callee: 0x1135f65a0
returnPC: 0x50ce61227e99
callerFrame: 0x7ffee8285770
rawLocationBits: 4 0x4
codeBlock: 0x1135bd0a0 #BU6Zcd:[0x1135bd0a0->0x1135bc260->0x1135e5180, DFGFunctionCall, 112 (DidTryToEnterInLoop)]

hasCodeOrigins: true
callSiteIndex: 4 of 12
jitCode: 0x113004000 start 0x50ce61212c60 end 0x50ce61214960
line: 26
column: 22

EntryFrame: 0x7ffee8285860

}
[2] frame 0x7ffee8285770 {

name:
sourceURL: date-format-xparb.js
isInlinedFrame: false
callee: 0x1135f64e0
returnPC: 0x108058eb1
callerFrame: 0x7ffee82857e0
rawLocationBits: 1001 0x3e9
codeBlock: 0x1135bc130 #DAS9xe:[0x1135bc130->0x1135e5100, BaselineFunctionCall, 1149]

bc#1001 of 1149
line: 417
column: 38

EntryFrame: 0x7ffee8285860

}
[3] frame 0x7ffee82857e0 {

name: global code
sourceURL: date-format-xparb.js
isInlinedFrame: false
callee: 0x1130f97b8
returnPC: 0x108039043
callerFrame: 0x0
rawLocationBits: 23 0x17
codeBlock: 0x1135bc000 <global>#CukXvt:[0x1135bc000->0x1130cd768, LLIntGlobal, 81]

bc#23 of 81
line: 425
column: 3

EntryFrame: 0x7ffee8285860

}

ASSERTION FAILED: expectDoesGC()

The error message now comes with the node index, NodeType, codeBlock which this
failure was found in, and the JS call stack that led to the failure.

Changes made:

  1. Introduced a DoesGCCheck value that is used to encode some of the above data.

Previously, we only recorded whether doesGC() returns true or false for the
Node. Now, we record the nodeIndex and nodeOp as well.

Note that we also set DoesGC expectations for OSR exits. So, DoesGCCheck
includes Special cases for those.

  1. Added store64(TrustedImm64 imm, const void* address) emitters for X86_64 and ARM64. Also added a test for this new emitter in testmasm.
  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::store64):

  • assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::store64):

  • assembler/testmasm.cpp:

(JSC::testStore64Imm64AddressPointer):
(JSC::run):

  • dfg/DFGDoesGCCheck.cpp: Added.

(JSC::DFG::DoesGCCheck::verifyCanGC):

  • dfg/DFGDoesGCCheck.h: Added.

(JSC::DFG::DoesGCCheck::DoesGCCheck):
(JSC::DFG::DoesGCCheck::encode):
(JSC::DFG::DoesGCCheck::set):
(JSC::DFG::DoesGCCheck::expectDoesGC):
(JSC::DFG::DoesGCCheck::special):
(JSC::DFG::DoesGCCheck::nodeIndex):
(JSC::DFG::DoesGCCheck::nodeOp):
(JSC::DFG::DoesGCCheck::isSpecial):
(JSC::DFG::DoesGCCheck::specialIndex):
(JSC::DFG::DoesGCCheck::bits):

  • dfg/DFGGraph.cpp:
  • dfg/DFGOSRExit.cpp:

(JSC::DFG::operationCompileOSRExit):
(JSC::DFG::OSRExit::compileExit):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):

  • ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):
(JSC::FTL::operationCompileFTLOSRExit):

  • heap/CompleteSubspace.cpp:

(JSC::CompleteSubspace::tryAllocateSlow):
(JSC::CompleteSubspace::reallocatePreciseAllocationNonVirtual):

  • heap/CompleteSubspaceInlines.h:

(JSC::CompleteSubspace::allocateNonVirtual):

  • heap/DeferGC.h:

(JSC::DeferGC::~DeferGC):

  • heap/GCDeferralContextInlines.h:

(JSC::GCDeferralContext::~GCDeferralContext):

  • heap/Heap.cpp:

(JSC::Heap::collectNow):
(JSC::Heap::collectAsync):
(JSC::Heap::collectSync):
(JSC::Heap::stopIfNecessarySlow):
(JSC::Heap::collectIfNecessaryOrDefer):

  • heap/Heap.h:

(JSC::Heap::addressOfDoesGC):
(JSC::Heap::setDoesGCExpectation):
(JSC::Heap::verifyCanGC):
(JSC::Heap::expectDoesGC const): Deleted.
(JSC::Heap::setExpectDoesGC): Deleted.
(JSC::Heap::addressOfExpectDoesGC): Deleted.

  • heap/HeapInlines.h:

(JSC::Heap::acquireAccess):
(JSC::Heap::stopIfNecessary):

  • heap/LocalAllocatorInlines.h:

(JSC::LocalAllocator::allocate):

  • heap/PreciseAllocation.cpp:

(JSC::PreciseAllocation::tryCreate):
(JSC::PreciseAllocation::createForLowerTier):

  • runtime/JSString.h:

(JSC::jsSingleCharacterString):
(JSC::JSString::toAtomString const):
(JSC::JSString::toExistingAtomString const):
(JSC::JSString::value const):
(JSC::JSString::tryGetValue const):
(JSC::JSRopeString::unsafeView const):
(JSC::JSRopeString::viewWithUnderlyingString const):
(JSC::JSString::unsafeView const):

  • runtime/RegExpMatchesArray.h:

(JSC::createRegExpMatchesArray):

Location:
trunk/Source/JavaScriptCore
Files:
2 added
23 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r262203 r262475  
    565565    dfg/DFGCommon.h
    566566    dfg/DFGCompilationMode.h
     567    dfg/DFGDoesGCCheck.h
    567568    dfg/DFGMinifiedID.h
    568569

  • trunk/Source/JavaScriptCore/ChangeLog

    r262467 r262475  
     12020-06-02  Mark Lam  <mark.lam@apple.com>
     2
     3        Enhance DoesGC verification to print more useful info when verification fails.
     4        https://bugs.webkit.org/show_bug.cgi?id=212680
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        When DoesGC verification fails, the first step of debugging it would be to find
     9        out what and which DFG node resulted in the failed verification.  In pre-existing
     10        code, all we get is an assertion failure.
     11
     12        This patch makes it so that the verifier will dump useful info.  Here's an example:
     13
     14            Error: DoesGC failed @ D@34 DateGetInt32OrNaN in #DtCHMz:[0x1135bd1d0->0x1135bcab0->0x1135e5c80, DFGFunctionCall, 150 (DidTryToEnterInLoop)]
     15                [0] frame 0x7ffee8285660 {
     16                  name:
     17                  sourceURL:
     18                  isInlinedFrame: false
     19                  callee: 0x1135f6820
     20                  returnPC: 0x50ce61248ae6
     21                  callerFrame: 0x7ffee82856f0
     22                  rawLocationBits: 5 0x5
     23                  codeBlock: 0x1135bd1d0 #DtCHMz:[0x1135bd1d0->0x1135bcab0->0x1135e5c80, DFGFunctionCall, 150 (DidTryToEnterInLoop)]
     24                    hasCodeOrigins: true
     25                    callSiteIndex: 5 of 13
     26                    jitCode: 0x113020200 start 0x50ce61214c60 end 0x50ce61219b00
     27                    line: 1
     28                    column: 60
     29                  EntryFrame: 0x7ffee8285860
     30                }
     31                [1] frame 0x7ffee82856f0 {
     32                  name:
     33                  sourceURL: date-format-xparb.js
     34                  isInlinedFrame: false
     35                  callee: 0x1135f65a0
     36                  returnPC: 0x50ce61227e99
     37                  callerFrame: 0x7ffee8285770
     38                  rawLocationBits: 4 0x4
     39                  codeBlock: 0x1135bd0a0 #BU6Zcd:[0x1135bd0a0->0x1135bc260->0x1135e5180, DFGFunctionCall, 112 (DidTryToEnterInLoop)]
     40                    hasCodeOrigins: true
     41                    callSiteIndex: 4 of 12
     42                    jitCode: 0x113004000 start 0x50ce61212c60 end 0x50ce61214960
     43                    line: 26
     44                    column: 22
     45                  EntryFrame: 0x7ffee8285860
     46                }
     47                [2] frame 0x7ffee8285770 {
     48                  name:
     49                  sourceURL: date-format-xparb.js
     50                  isInlinedFrame: false
     51                  callee: 0x1135f64e0
     52                  returnPC: 0x108058eb1
     53                  callerFrame: 0x7ffee82857e0
     54                  rawLocationBits: 1001 0x3e9
     55                  codeBlock: 0x1135bc130 #DAS9xe:[0x1135bc130->0x1135e5100, BaselineFunctionCall, 1149]
     56                    bc#1001 of 1149
     57                    line: 417
     58                    column: 38
     59                  EntryFrame: 0x7ffee8285860
     60                }
     61                [3] frame 0x7ffee82857e0 {
     62                  name: global code
     63                  sourceURL: date-format-xparb.js
     64                  isInlinedFrame: false
     65                  callee: 0x1130f97b8
     66                  returnPC: 0x108039043
     67                  callerFrame: 0x0
     68                  rawLocationBits: 23 0x17
     69                  codeBlock: 0x1135bc000 <global>#CukXvt:[0x1135bc000->0x1130cd768, LLIntGlobal, 81]
     70                    bc#23 of 81
     71                    line: 425
     72                    column: 3
     73                  EntryFrame: 0x7ffee8285860
     74                }
     75
     76            ASSERTION FAILED: expectDoesGC()
     77
     78        The error message now comes with the node index, NodeType, codeBlock which this
     79        failure was found in, and the JS call stack that led to the failure.
     80
     81        Changes made:
     82
     83        1. Introduced a DoesGCCheck value that is used to encode some of the above data.
     84
     85           Previously, we only recorded whether doesGC() returns true or false for the
     86           Node.  Now, we record the nodeIndex and nodeOp as well.
     87
     88           Note that we also set DoesGC expectations for OSR exits.  So, DoesGCCheck
     89           includes Special cases for those.
     90
     91        2. Added store64(TrustedImm64 imm, const void* address) emitters for X86_64 and ARM64.
     92           Also added a test for this new emitter in testmasm.
     93
     94        * CMakeLists.txt:
     95        * JavaScriptCore.xcodeproj/project.pbxproj:
     96        * Sources.txt:
     97        * assembler/MacroAssemblerARM64.h:
     98        (JSC::MacroAssemblerARM64::store64):
     99        * assembler/MacroAssemblerX86_64.h:
     100        (JSC::MacroAssemblerX86_64::store64):
     101        * assembler/testmasm.cpp:
     102        (JSC::testStore64Imm64AddressPointer):
     103        (JSC::run):
     104        * dfg/DFGDoesGCCheck.cpp: Added.
     105        (JSC::DFG::DoesGCCheck::verifyCanGC):
     106        * dfg/DFGDoesGCCheck.h: Added.
     107        (JSC::DFG::DoesGCCheck::DoesGCCheck):
     108        (JSC::DFG::DoesGCCheck::encode):
     109        (JSC::DFG::DoesGCCheck::set):
     110        (JSC::DFG::DoesGCCheck::expectDoesGC):
     111        (JSC::DFG::DoesGCCheck::special):
     112        (JSC::DFG::DoesGCCheck::nodeIndex):
     113        (JSC::DFG::DoesGCCheck::nodeOp):
     114        (JSC::DFG::DoesGCCheck::isSpecial):
     115        (JSC::DFG::DoesGCCheck::specialIndex):
     116        (JSC::DFG::DoesGCCheck::bits):
     117        * dfg/DFGGraph.cpp:
     118        * dfg/DFGOSRExit.cpp:
     119        (JSC::DFG::operationCompileOSRExit):
     120        (JSC::DFG::OSRExit::compileExit):
     121        * dfg/DFGSpeculativeJIT64.cpp:
     122        (JSC::DFG::SpeculativeJIT::compile):
     123        * ftl/FTLLowerDFGToB3.cpp:
     124        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
     125        * ftl/FTLOSRExitCompiler.cpp:
     126        (JSC::FTL::compileStub):
     127        (JSC::FTL::operationCompileFTLOSRExit):
     128        * heap/CompleteSubspace.cpp:
     129        (JSC::CompleteSubspace::tryAllocateSlow):
     130        (JSC::CompleteSubspace::reallocatePreciseAllocationNonVirtual):
     131        * heap/CompleteSubspaceInlines.h:
     132        (JSC::CompleteSubspace::allocateNonVirtual):
     133        * heap/DeferGC.h:
     134        (JSC::DeferGC::~DeferGC):
     135        * heap/GCDeferralContextInlines.h:
     136        (JSC::GCDeferralContext::~GCDeferralContext):
     137        * heap/Heap.cpp:
     138        (JSC::Heap::collectNow):
     139        (JSC::Heap::collectAsync):
     140        (JSC::Heap::collectSync):
     141        (JSC::Heap::stopIfNecessarySlow):
     142        (JSC::Heap::collectIfNecessaryOrDefer):
     143        * heap/Heap.h:
     144        (JSC::Heap::addressOfDoesGC):
     145        (JSC::Heap::setDoesGCExpectation):
     146        (JSC::Heap::verifyCanGC):
     147        (JSC::Heap::expectDoesGC const): Deleted.
     148        (JSC::Heap::setExpectDoesGC): Deleted.
     149        (JSC::Heap::addressOfExpectDoesGC): Deleted.
     150        * heap/HeapInlines.h:
     151        (JSC::Heap::acquireAccess):
     152        (JSC::Heap::stopIfNecessary):
     153        * heap/LocalAllocatorInlines.h:
     154        (JSC::LocalAllocator::allocate):
     155        * heap/PreciseAllocation.cpp:
     156        (JSC::PreciseAllocation::tryCreate):
     157        (JSC::PreciseAllocation::createForLowerTier):
     158        * runtime/JSString.h:
     159        (JSC::jsSingleCharacterString):
     160        (JSC::JSString::toAtomString const):
     161        (JSC::JSString::toExistingAtomString const):
     162        (JSC::JSString::value const):
     163        (JSC::JSString::tryGetValue const):
     164        (JSC::JSRopeString::unsafeView const):
     165        (JSC::JSRopeString::viewWithUnderlyingString const):
     166        (JSC::JSString::unsafeView const):
     167        * runtime/RegExpMatchesArray.h:
     168        (JSC::createRegExpMatchesArray):
     169
    11702020-06-02  Mark Lam  <mark.lam@apple.com>
    2171

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r262308 r262475  
    19371937                FEB58C15187B8B160098EF0B /* ErrorHandlingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FEB58C13187B8B160098EF0B /* ErrorHandlingScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
    19381938                FEC160322339E9F900A04CB8 /* CellSize.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC160312339E9F900A04CB8 /* CellSize.h */; };
     1939                FEC3A3A1248735CA00395B54 /* DFGDoesGCCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC3A3A0248735BC00395B54 /* DFGDoesGCCheck.h */; settings = {ATTRIBUTES = (Private, ); }; };
    19391940                FEC5797323105B5100BCA83F /* VMInspectorInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC5797223105B4800BCA83F /* VMInspectorInlines.h */; };
    19401941                FEC5797623105F4E00BCA83F /* Integrity.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC5797523105F4300BCA83F /* Integrity.h */; settings = {ATTRIBUTES = (Private, ); }; };
    … …  
    52335234                FEB58C13187B8B160098EF0B /* ErrorHandlingScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorHandlingScope.h; sourceTree = "<group>"; };
    52345235                FEC160312339E9F900A04CB8 /* CellSize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CellSize.h; sourceTree = "<group>"; };
     5236                FEC3A39F248735BC00395B54 /* DFGDoesGCCheck.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDoesGCCheck.cpp; path = dfg/DFGDoesGCCheck.cpp; sourceTree = "<group>"; };
     5237                FEC3A3A0248735BC00395B54 /* DFGDoesGCCheck.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = DFGDoesGCCheck.h; path = dfg/DFGDoesGCCheck.h; sourceTree = "<group>"; };
    52355238                FEC5797223105B4800BCA83F /* VMInspectorInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VMInspectorInlines.h; sourceTree = "<group>"; };
    52365239                FEC5797423105F4200BCA83F /* Integrity.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Integrity.cpp; sourceTree = "<group>"; };
    … …  
    78977900                                0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */,
    78987901                                0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */,
     7902                                FEC3A39F248735BC00395B54 /* DFGDoesGCCheck.cpp */,
     7903                                FEC3A3A0248735BC00395B54 /* DFGDoesGCCheck.h */,
    78997904                                0FD81AD0154FB4EB00983E72 /* DFGDominators.h */,
    79007905                                0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */,
    … …  
    1019710202                                0FE050281AA9095600D33B33 /* ScopedArguments.h in Headers */,
    1019810203                                0FE050291AA9095600D33B33 /* ScopedArgumentsTable.h in Headers */,
     10204                                FEC3A3A1248735CA00395B54 /* DFGDoesGCCheck.h in Headers */,
    1019910205                                0FE0502B1AA9095600D33B33 /* ScopeOffset.h in Headers */,
    1020010206                                0F24E55217EE274900ABB217 /* ScratchRegisterAllocator.h in Headers */,

  • trunk/Source/JavaScriptCore/Sources.txt

    r261600 r262475  
    348348dfg/DFGDisassembler.cpp
    349349dfg/DFGDoesGC.cpp
     350dfg/DFGDoesGCCheck.cpp
    350351dfg/DFGDriver.cpp
    351352dfg/DFGEdge.cpp

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h

    r262168 r262475  
    14601460    }
    14611461
     1462    void store64(TrustedImm64 imm, const void* address)
     1463    {
     1464        if (!imm.m_value) {
     1465            store64(ARM64Registers::zr, address);
     1466            return;
     1467        }
     1468
     1469        moveToCachedReg(imm, dataMemoryTempRegister());
     1470        store64(dataTempRegister, address);
     1471    }
     1472
    14621473    void store64(TrustedImm32 imm, ImplicitAddress address)
    14631474    {

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h

    r262168 r262475  
    978978    }
    979979
     980    void store64(TrustedImm64 imm, void* address)
     981    {
     982        if (CAN_SIGN_EXTEND_32_64(imm.m_value)) {
     983            auto addressReg = scratchRegister();
     984            move(TrustedImmPtr(address), addressReg);
     985            store64(TrustedImm32(static_cast<int32_t>(imm.m_value)), addressReg);
     986            return;
     987        }
     988
     989        auto src = scratchRegister();
     990        move(imm, src);
     991        swap(src, X86Registers::eax);
     992        m_assembler.movq_EAXm(address);
     993        swap(src, X86Registers::eax);
     994    }
     995
    980996    void store64(TrustedImm64 imm, ImplicitAddress address)
    981997    {

  • trunk/Source/JavaScriptCore/assembler/testmasm.cpp

    r262434 r262475  
    659659    testCountTrailingZeros64Impl(wordCanBeZero);
    660660}
     661
     662void testStore64Imm64AddressPointer()
     663{
     664    auto doTest = [] (int64_t value) {
     665        int64_t dest;
     666        void* destAddress = &dest;
     667
     668        auto test = compile([=] (CCallHelpers& jit) {
     669            emitFunctionPrologue(jit);
     670            jit.store64(CCallHelpers::TrustedImm64(value), destAddress);
     671            emitFunctionEpilogue(jit);
     672            jit.ret();
     673        });
     674
     675        invoke<size_t>(test);
     676        CHECK_EQ(dest, value);
     677    };
     678   
     679    for (auto value : int64Operands())
     680        doTest(value);
     681
     682    doTest(0x98765555AAAA4321);
     683    doTest(0xAAAA432198765555);
     684}
     685
    661686#endif // CPU(X86_64) || CPU(ARM64)
    662687
    … …  
    25002525    RUN(testCountTrailingZeros64());
    25012526    RUN(testCountTrailingZeros64WithoutNullCheck());
     2527    RUN(testStore64Imm64AddressPointer());
    25022528#endif
    25032529

  • trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

    r261895 r262475  
    6363
    6464// Creates an array of stringized names.
    65 static const char* dfgOpNames[] = {
     65const char* dfgOpNames[] = {
    6666#define STRINGIZE_DFG_OP_ENUM(opcode, flags) #opcode ,
    6767    FOR_EACH_DFG_OP(STRINGIZE_DFG_OP_ENUM)

  • trunk/Source/JavaScriptCore/dfg/DFGOSRExit.cpp

    r261895 r262475  
    147147        // We're about to exit optimized code. So, there's no longer any optimized
    148148        // code running that expects no GC.
    149         vm.heap.setExpectDoesGC(true);
     149        vm.heap.setDoesGCExpectation(true, DoesGCCheck::Special::DFGOSRExit);
    150150    }
    151151
    … …  
    556556        // materialization below (see emitRestoreArguments()).
    557557
    558         // Even though we set Heap::m_expectDoesGC in compileOSRExit(), we also need
     558        // Even though we set Heap::m_doesGC in compileOSRExit(), we also need
    559559        // to set it here because compileOSRExit() is only called on the first time
    560560        // we exit from this site, but all subsequent exits will take this compiled
    561561        // ramp without calling compileOSRExit() first.
    562         jit.store8(CCallHelpers::TrustedImm32(true), vm.heap.addressOfExpectDoesGC());
     562        jit.store64(CCallHelpers::TrustedImm64(DoesGCCheck::encode(true, DoesGCCheck::Special::DFGOSRExit)), vm.heap.addressOfDoesGC());
    563563    }
    564564

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r262252 r262475  
    21392139    if (validateDFGDoesGC) {
    21402140        bool expectDoesGC = doesGC(m_jit.graph(), node);
    2141         m_jit.store8(TrustedImm32(expectDoesGC), vm().heap.addressOfExpectDoesGC());
     2141        m_jit.store64(TrustedImm64(DoesGCCheck::encode(expectDoesGC, node->index(), node->op())), vm().heap.addressOfDoesGC());
    21422142    }
    21432143

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r262434 r262475  
    705705        if (validateDFGDoesGC) {
    706706            bool expectDoesGC = doesGC(m_graph, m_node);
    707             m_out.store(m_out.constBool(expectDoesGC), m_out.absolute(vm().heap.addressOfExpectDoesGC()));
     707            m_out.store(m_out.constInt64(DoesGCCheck::encode(expectDoesGC, m_node->index(), m_node->op())), m_out.absolute(vm().heap.addressOfDoesGC()));
    708708        }
    709709

  • trunk/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp

    r262098 r262475  
    212212        // materialization below.
    213213
    214         // Even though we set Heap::m_expectDoesGC in compileFTLOSRExit(), we also need
     214        // Even though we set Heap::m_doesGC in compileFTLOSRExit(), we also need
    215215        // to set it here because compileFTLOSRExit() is only called on the first time
    216216        // we exit from this site, but all subsequent exits will take this compiled
    217217        // ramp without calling compileFTLOSRExit() first.
    218         jit.store8(CCallHelpers::TrustedImm32(true), vm.heap.addressOfExpectDoesGC());
     218        jit.store64(CCallHelpers::TrustedImm64(DoesGCCheck::encode(true, DoesGCCheck::Special::FTLOSRExit)), vm.heap.addressOfDoesGC());
    219219    }
    220220
    … …  
    549549        // We're about to exit optimized code. So, there's no longer any optimized
    550550        // code running that expects no GC.
    551         vm.heap.setExpectDoesGC(true);
     551        vm.heap.setDoesGCExpectation(true, DoesGCCheck::Special::FTLOSRExit);
    552552    }
    553553

  • trunk/Source/JavaScriptCore/heap/CompleteSubspace.cpp

    r261755 r262475  
    11/*
    2  * Copyright (C) 2017-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2017-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    121121{
    122122    if (validateDFGDoesGC)
    123         RELEASE_ASSERT(vm.heap.expectDoesGC());
     123        vm.heap.verifyCanGC();
    124124
    125125    sanitizeStackForVM(vm);
    … …  
    157157{
    158158    if (validateDFGDoesGC)
    159         RELEASE_ASSERT(vm.heap.expectDoesGC());
     159        vm.heap.verifyCanGC();
    160160
    161161    // The following conditions are met in Butterfly for example.

  • trunk/Source/JavaScriptCore/heap/CompleteSubspaceInlines.h

    r252452 r262475  
    11/*
    2  * Copyright (C) 2018-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2018-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3434{
    3535    if (validateDFGDoesGC)
    36         RELEASE_ASSERT(vm.heap.expectDoesGC());
     36        vm.heap.verifyCanGC();
    3737
    3838    if (Allocator allocator = allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists))

  • trunk/Source/JavaScriptCore/heap/DeferGC.h

    r252671 r262475  
    11/*
    2  * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4646    {
    4747        if (validateDFGDoesGC)
    48             RELEASE_ASSERT(m_heap.expectDoesGC());
     48            m_heap.verifyCanGC();
    4949        m_heap.decrementDeferralDepthAndGCIfNeeded();
    5050    }

  • trunk/Source/JavaScriptCore/heap/GCDeferralContextInlines.h

    r241927 r262475  
    11/*
    2  * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2016-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3939{
    4040    if (validateDFGDoesGC)
    41         RELEASE_ASSERT(m_heap.expectDoesGC());
     41        m_heap.verifyCanGC();
    4242
    4343    if (UNLIKELY(m_shouldGC))

  • trunk/Source/JavaScriptCore/heap/Heap.cpp

    r262040 r262475  
    11/*
    2  *  Copyright (C) 2003-2019 Apple Inc. All rights reserved.
     2 *  Copyright (C) 2003-2020 Apple Inc. All rights reserved.
    33 *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
    44 *
    … …  
    10651065{
    10661066    if (validateDFGDoesGC)
    1067         RELEASE_ASSERT(expectDoesGC());
     1067        verifyCanGC();
    10681068
    10691069    switch (synchronousness) {
    … …  
    10981098{
    10991099    if (validateDFGDoesGC)
    1100         RELEASE_ASSERT(expectDoesGC());
     1100        verifyCanGC();
    11011101
    11021102    if (!m_isSafeToCollect)
    … …  
    11221122{
    11231123    if (validateDFGDoesGC)
    1124         RELEASE_ASSERT(expectDoesGC());
     1124        verifyCanGC();
    11251125
    11261126    if (!m_isSafeToCollect)
    … …  
    17851785{
    17861786    if (validateDFGDoesGC)
    1787         RELEASE_ASSERT(expectDoesGC());
     1787        verifyCanGC();
    17881788
    17891789    while (stopIfNecessarySlow(m_worldState.load())) { }
    … …  
    18001800{
    18011801    if (validateDFGDoesGC)
    1802         RELEASE_ASSERT(expectDoesGC());
     1802        verifyCanGC();
    18031803
    18041804    RELEASE_ASSERT(oldState & hasAccessBit);
    … …  
    26022602    ASSERT(deferralContext || isDeferred() || !DisallowGC::isInEffectOnCurrentThread());
    26032603    if (validateDFGDoesGC)
    2604         RELEASE_ASSERT(expectDoesGC());
     2604        verifyCanGC();
    26052605
    26062606    if (!m_isSafeToCollect)

  • trunk/Source/JavaScriptCore/heap/Heap.h

    r261569 r262475  
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    33 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
    4  *  Copyright (C) 2003-2019 Apple Inc. All rights reserved.
     4 *  Copyright (C) 2003-2020 Apple Inc. All rights reserved.
    55 *
    66 *  This library is free software; you can redistribute it and/or
    … …  
    2626#include "CollectionScope.h"
    2727#include "CollectorPhase.h"
     28#include "DFGDoesGCCheck.h"
    2829#include "DeleteAllCodeEffort.h"
    2930#include "GCConductor.h"
    … …  
    304305
    305306#if ENABLE(DFG_DOES_GC_VALIDATION)
    306     bool expectDoesGC() const { return m_expectDoesGC; }
    307     void setExpectDoesGC(bool value) { m_expectDoesGC = value; }
    308     bool* addressOfExpectDoesGC() { return &m_expectDoesGC; }
     307    DoesGCCheck* addressOfDoesGC() { return &m_doesGC; }
     308    void setDoesGCExpectation(bool expectDoesGC, unsigned nodeIndex, unsigned nodeOp) { m_doesGC.set(expectDoesGC, nodeIndex, nodeOp); }
     309    void setDoesGCExpectation(bool expectDoesGC, DoesGCCheck::Special special) { m_doesGC.set(expectDoesGC, special); }
     310    void verifyCanGC() { m_doesGC.verifyCanGC(vm()); }
    309311#else
    310     bool expectDoesGC() const { UNREACHABLE_FOR_PLATFORM(); return true; }
    311     void setExpectDoesGC(bool) { UNREACHABLE_FOR_PLATFORM(); }
    312     bool* addressOfExpectDoesGC() { UNREACHABLE_FOR_PLATFORM(); return nullptr; }
     312    DoesGCCheck* addressOfDoesGC() { UNREACHABLE_FOR_PLATFORM(); return nullptr; }
     313    void setDoesGCExpectation(bool, unsigned, unsigned) { }
     314    void setDoesGCExpectation(bool, DoesGCCheck::Special) { }
     315    void verifyCanGC() { }
    313316#endif
    314317
    … …  
    607610    Lock m_raceMarkStackLock;
    608611#if ENABLE(DFG_DOES_GC_VALIDATION)
    609     bool m_expectDoesGC { true };
     612    DoesGCCheck m_doesGC;
    610613#endif
    611614

  • trunk/Source/JavaScriptCore/heap/HeapInlines.h

    r255897 r262475  
    237237{
    238238    if (validateDFGDoesGC)
    239         RELEASE_ASSERT(expectDoesGC());
     239        verifyCanGC();
    240240
    241241    if (m_worldState.compareExchangeWeak(0, hasAccessBit))
    … …  
    264264{
    265265    if (validateDFGDoesGC)
    266         RELEASE_ASSERT(expectDoesGC());
     266        verifyCanGC();
    267267
    268268    if (mayNeedToStop())

  • trunk/Source/JavaScriptCore/heap/LocalAllocatorInlines.h

    r252452 r262475  
    3434{
    3535    if (validateDFGDoesGC)
    36         RELEASE_ASSERT(heap.expectDoesGC());
     36        heap.verifyCanGC();
    3737    return m_freeList.allocate(
    3838        [&] () -> HeapCell* {

  • trunk/Source/JavaScriptCore/heap/PreciseAllocation.cpp

    r261895 r262475  
    4444{
    4545    if (validateDFGDoesGC)
    46         RELEASE_ASSERT(heap.expectDoesGC());
     46        heap.verifyCanGC();
    4747
    4848    size_t adjustedAlignmentAllocationSize = headerSize() + size + halfAlignment;
    … …  
    124124{
    125125    if (validateDFGDoesGC)
    126         RELEASE_ASSERT(heap.expectDoesGC());
     126        heap.verifyCanGC();
    127127
    128128    size_t adjustedAlignmentAllocationSize = headerSize() + size + halfAlignment;

  • trunk/Source/JavaScriptCore/runtime/JSString.h

    r260331 r262475  
    734734{
    735735    if (validateDFGDoesGC)
    736         RELEASE_ASSERT(vm.heap.expectDoesGC());
     736        vm.heap.verifyCanGC();
    737737    if (c <= maxSingleCharacterString)
    738738        return vm.smallStrings.singleCharacterString(c);
    … …  
    764764{
    765765    if (validateDFGDoesGC)
    766         RELEASE_ASSERT(vm().heap.expectDoesGC());
     766        vm().heap.verifyCanGC();
    767767    if (isRope())
    768768        return static_cast<const JSRopeString*>(this)->resolveRopeToAtomString(globalObject);
    … …  
    773773{
    774774    if (validateDFGDoesGC)
    775         RELEASE_ASSERT(vm().heap.expectDoesGC());
     775        vm().heap.verifyCanGC();
    776776    if (isRope())
    777777        return static_cast<const JSRopeString*>(this)->resolveRopeToExistingAtomString(globalObject);
    … …  
    784784{
    785785    if (validateDFGDoesGC)
    786         RELEASE_ASSERT(vm().heap.expectDoesGC());
     786        vm().heap.verifyCanGC();
    787787    if (isRope())
    788788        return static_cast<const JSRopeString*>(this)->resolveRope(globalObject);
    … …  
    794794    if (allocationAllowed) {
    795795        if (validateDFGDoesGC)
    796             RELEASE_ASSERT(vm().heap.expectDoesGC());
     796            vm().heap.verifyCanGC();
    797797        if (isRope()) {
    798798            // Pass nullptr for the JSGlobalObject so that resolveRope does not throw in the event of an OOM error.
    … …  
    984984{
    985985    if (validateDFGDoesGC)
    986         RELEASE_ASSERT(vm().heap.expectDoesGC());
     986        vm().heap.verifyCanGC();
    987987    if (isSubstring()) {
    988988        auto& base = substringBase()->valueInternal();
    … …  
    997997{
    998998    if (validateDFGDoesGC)
    999         RELEASE_ASSERT(vm().heap.expectDoesGC());
     999        vm().heap.verifyCanGC();
    10001000    if (isSubstring()) {
    10011001        auto& base = substringBase()->valueInternal();
    … …  
    10111011{
    10121012    if (validateDFGDoesGC)
    1013         RELEASE_ASSERT(vm().heap.expectDoesGC());
     1013        vm().heap.verifyCanGC();
    10141014    if (isRope())
    10151015        return static_cast<const JSRopeString*>(this)->unsafeView(globalObject);

  • trunk/Source/JavaScriptCore/runtime/RegExpMatchesArray.h

    r261464 r262475  
    6565{
    6666    if (validateDFGDoesGC)
    67         RELEASE_ASSERT(vm.heap.expectDoesGC());
     67        vm.heap.verifyCanGC();
    6868
    6969    Vector<int, 32> subpatternResults;
Note: See TracChangeset for help on using the changeset viewer.