Changeset 267726 in webkit


Ignore:
Timestamp:
Sep 28, 2020, 9:54:36 PM (5 years ago)
Author:
mark.lam@apple.com
Message:

Add Bounds Check Elimination validation for debugging.
​https://bugs.webkit.org/show_bug.cgi?id=217055
rdar://69122891

Reviewed by Keith Miller.

Source/JavaScriptCore:

Added a JSC_validateBoundsCheckElimination option (with alias
JSC_validateBCE) that adds an AssertInBounds whenever a CheckInBounds
node is elided.

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGIntegerCheckCombiningPhase.cpp:

(JSC::DFG::IntegerCheckCombiningPhase::handleBlock):

  • dfg/DFGIntegerRangeOptimizationPhase.cpp:
  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.h:
  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGValidate.cpp:
  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileAssertNotEmpty):
(JSC::FTL::DFG::LowerDFGToB3::compileAssertInBounds):

  • ftl/FTLOperations.cpp:

(JSC::FTL::operationReportBoundsCheckEliminationErrorAndCrash):

  • ftl/FTLOperations.h:
  • runtime/OptionsList.h:

Tools:

Added --validateBCE=true to ftl-no-cjit-validate-sampling-profiler
and ftl-eager-no-cjit.

  • Scripts/run-jsc-stress-tests:
Location:
trunk
Files:
21 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r267624 r267726  
     12020-09-28  Mark Lam  <mark.lam@apple.com>
     2
     3        Add Bounds Check Elimination validation for debugging.
     4        https://bugs.webkit.org/show_bug.cgi?id=217055
     5        rdar://69122891
     6
     7        Reviewed by Keith Miller.
     8
     9        Added a JSC_validateBoundsCheckElimination option (with alias
     10        JSC_validateBCE) that adds an AssertInBounds whenever a CheckInBounds
     11        node is elided.
     12
     13        * dfg/DFGAbstractInterpreterInlines.h:
     14        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
     15        * dfg/DFGClobberize.h:
     16        (JSC::DFG::clobberize):
     17        * dfg/DFGDoesGC.cpp:
     18        (JSC::DFG::doesGC):
     19        * dfg/DFGFixupPhase.cpp:
     20        (JSC::DFG::FixupPhase::fixupNode):
     21        * dfg/DFGIntegerCheckCombiningPhase.cpp:
     22        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
     23        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
     24        * dfg/DFGNodeType.h:
     25        * dfg/DFGOperations.h:
     26        * dfg/DFGPredictionPropagationPhase.cpp:
     27        * dfg/DFGSafeToExecute.h:
     28        (JSC::DFG::safeToExecute):
     29        * dfg/DFGSpeculativeJIT32_64.cpp:
     30        (JSC::DFG::SpeculativeJIT::compile):
     31        * dfg/DFGSpeculativeJIT64.cpp:
     32        (JSC::DFG::SpeculativeJIT::compile):
     33        * dfg/DFGValidate.cpp:
     34        * ftl/FTLCapabilities.cpp:
     35        (JSC::FTL::canCompile):
     36        * ftl/FTLLowerDFGToB3.cpp:
     37        (JSC::FTL::DFG::LowerDFGToB3::validateAIState):
     38        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
     39        (JSC::FTL::DFG::LowerDFGToB3::compileAssertNotEmpty):
     40        (JSC::FTL::DFG::LowerDFGToB3::compileAssertInBounds):
     41        * ftl/FTLOperations.cpp:
     42        (JSC::FTL::operationReportBoundsCheckEliminationErrorAndCrash):
     43        * ftl/FTLOperations.h:
     44        * runtime/OptionsList.h:
     45
    1462020-09-26  Yusuke Suzuki  <ysuzuki@apple.com>
    247

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r267624 r267726  
    40154015    }
    40164016
     4017    case AssertInBounds:
     4018        break;
     4019
    40174020    case CheckInBounds: {
    40184021        JSValue left = forNode(node->child1()).value();

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r267489 r267726  
    458458        return;
    459459
     460    case AssertInBounds:
    460461    case AssertNotEmpty:
    461462        write(SideState);

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r267489 r267726  
    11/*
    2  * Copyright (C) 2014-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    183183    case InvalidationPoint:
    184184    case NotifyWrite:
     185    case AssertInBounds:
    185186    case CheckInBounds:
    186187    case ConstantStoragePointer:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r267489 r267726  
    21192119        case CheckTierUpAtReturn:
    21202120        case CheckTierUpAndOSREnter:
     2121        case AssertInBounds:
    21212122        case CheckInBounds:
    21222123        case ConstantStoragePointer:

  • trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp

    r261895 r267726  
    11/*
    2  * Copyright (C) 2014-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    283283               
    284284            case ArrayBounds:
     285                ASSERT(node->op() == CheckInBounds);
     286                if (UNLIKELY(Options::validateBoundsCheckElimination()))
     287                    m_insertionSet.insertNode(nodeIndex, SpecNone, AssertInBounds, node->origin, node->child1(), node->child2());
    285288                node->convertToIdentityOn(m_map[data.m_key].m_dependency);
    286289                m_changed = true;

  • trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

    r261895 r267726  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    13361336                    if (nonNegative && lessThanLength) {
    13371337                        executeNode(block->at(nodeIndex));
     1338                        if (UNLIKELY(Options::validateBoundsCheckElimination()))
     1339                            m_insertionSet.insertNode(nodeIndex, SpecNone, AssertInBounds, node->origin, node->child1(), node->child2());
    13381340                        // We just need to make sure we are a value-producing node.
    13391341                        node->convertToIdentityOn(node->child1().node());

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r267489 r267726  
    281281    macro(AssertNotEmpty, NodeMustGenerate) \
    282282    macro(CheckBadValue, NodeMustGenerate) \
     283    macro(AssertInBounds, NodeMustGenerate) \
    283284    macro(CheckInBounds, NodeMustGenerate | NodeResultJS) \
    284285    macro(CheckIdent, NodeMustGenerate) \

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r267624 r267726  
    331331void JIT_OPERATION operationProcessTypeProfilerLogDFG(VM*) WTF_INTERNAL;
    332332
    333 void JIT_OPERATION operationTriggerReoptimizationNow(CodeBlock* baselineCodeBlock, CodeBlock* optiimzedCodeBlock, OSRExitBase*) WTF_INTERNAL;
     333void JIT_OPERATION operationTriggerReoptimizationNow(CodeBlock* baselineCodeBlock, CodeBlock* optimizedCodeBlock, OSRExitBase*) WTF_INTERNAL;
    334334void triggerReoptimizationNow(CodeBlock* baselineCodeBlock, CodeBlock* optiimzedCodeBlock, OSRExitBase*); // This is not JIT_OPERATION.
    335335

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r267489 r267726  
    11/*
    2  * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    13161316        case CheckTierUpAtReturn:
    13171317        case CheckTierUpAndOSREnter:
     1318        case AssertInBounds:
    13181319        case CheckInBounds:
    13191320        case ValueToInt32:

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r267489 r267726  
    11/*
    2  * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    282282    case ExtractOSREntryLocal:
    283283    case ExtractCatchLocal:
     284    case AssertInBounds:
    284285    case CheckInBounds:
    285286    case ConstantStoragePointer:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r267489 r267726  
    42464246    case FiatInt52:
    42474247    case Int52Constant:
     4248    case AssertInBounds:
    42484249    case CheckInBounds:
    42494250    case ArithIMul:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r267624 r267726  
    56715671    case Upsilon:
    56725672    case ExtractOSREntryLocal:
     5673    case AssertInBounds:
    56735674    case CheckInBounds:
    56745675    case ArithIMul:

  • trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp

    r266101 r267726  
    11/*
    2  * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    639639                case Phi:
    640640                case Upsilon:
     641                case AssertInBounds:
    641642                case CheckInBounds:
    642643                case PhantomNewObject:

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r267489 r267726  
    11/*
    2  * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    197197    case Branch:
    198198    case LogicalNot:
     199    case AssertInBounds:
    199200    case CheckInBounds:
    200201    case ConstantStoragePointer:

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r267624 r267726  
    591591                continue;
    592592
     593            if (node->op() == AssertInBounds)
     594                continue;
    593595            if (node->op() == CheckInBounds)
    594596                continue;
    … …  
    996998        case GetVectorLength:
    997999            compileGetVectorLength();
     1000            break;
     1001        case AssertInBounds:
     1002            compileAssertInBounds();
    9981003            break;
    9991004        case CheckInBounds:
    … …  
    37143719            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
    37153720                AllowMacroScratchRegisterUsage allowScratch(jit);
    3716                 GPRReg input =  params[0].gpr();
     3721                GPRReg input = params[0].gpr();
    37173722                CCallHelpers::Jump done = jit.branchIfNotEmpty(input);
    37183723                jit.breakpoint();
    … …  
    46444649        }
    46454650    }
    4646    
     4651
     4652    void compileAssertInBounds()
     4653    {
     4654        ASSERT(Options::validateBoundsCheckElimination());
     4655        LValue index = lowInt32(m_node->child1());
     4656        LValue bounds = lowInt32(m_node->child2());
     4657
     4658        LBasicBlock outOfBoundsCase = m_out.newBlock();
     4659        LBasicBlock continuation = m_out.newBlock();
     4660        m_out.branch(m_out.below(index, bounds), usually(continuation), rarely(outOfBoundsCase));
     4661
     4662        LBasicBlock lastNext = m_out.appendTo(outOfBoundsCase, continuation);
     4663        vmCall(Void, operationReportBoundsCheckEliminationErrorAndCrash,
     4664            m_out.constIntPtr(bitwise_cast<intptr_t>(codeBlock())),
     4665            m_out.constInt32(m_node->index()),
     4666            m_out.constInt32(m_node->child1()->index()),
     4667            m_out.constInt32(m_node->child2()->index()),
     4668            index, bounds);
     4669        m_out.unreachable();
     4670
     4671        m_out.appendTo(continuation, lastNext);
     4672    }
     4673
    46474674    void compileCheckInBounds()
    46484675    {

  • trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

    r261755 r267726  
    11/*
    2  * Copyright (C) 2014-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4848#include "JSSetIterator.h"
    4949#include "RegExpObject.h"
     50#include <wtf/Assertions.h>
    5051
    5152IGNORE_WARNINGS_BEGIN("frame-address")
    … …  
    742743}
    743744
     745extern "C" NO_RETURN_DUE_TO_CRASH void JIT_OPERATION operationReportBoundsCheckEliminationErrorAndCrash(intptr_t codeBlockAsIntPtr, int32_t nodeIndex, int32_t child1Index, int32_t child2Index, int32_t checkedIndex, int32_t bounds)
     746{
     747    CodeBlock* codeBlock = bitwise_cast<CodeBlock*>(codeBlockAsIntPtr);
     748    dataLogLn("Bounds Check Eimination error found @ D@", nodeIndex, ": AssertInBounds(index D@", child1Index, ": ", checkedIndex, ", bounds D@", child2Index, " ", bounds, ") in ", codeBlock);
     749    CRASH();
     750}
     751
    744752} } // namespace JSC::FTL
    745753

  • trunk/Source/JavaScriptCore/ftl/FTLOperations.h

    r259320 r267726  
    11/*
    2  * Copyright (C) 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4646int32_t JIT_OPERATION operationTypeOfObjectAsTypeofType(JSGlobalObject*, JSCell*) WTF_INTERNAL;
    4747
     48void JIT_OPERATION operationReportBoundsCheckEliminationErrorAndCrash(intptr_t codeBlockAsIntPtr, int32_t, int32_t, int32_t, int32_t, int32_t);
     49
    4850} // extern "C"
    4951

  • trunk/Source/JavaScriptCore/runtime/OptionsList.h

    r267454 r267726  
    385385    v(Unsigned, unexpectedExceptionStackTraceLimit, 100, Normal, "Stack trace limit for debugging unexpected exceptions observed in the VM") \
    386386    \
    387     v(Bool, validateDFGClobberize, false, Normal, "Emits extra validation code in the DFG/FTL for the Clobberize phase")\
     387    v(Bool, validateDFGClobberize, false, Normal, "Emits code in the DFG/FTL to validate the Clobberize phase")\
     388    v(Bool, validateBoundsCheckElimination, false, Normal, "Emits code in the DFG/FTL to validate bounds check elimination")\
    388389    \
    389390    v(Bool, useExecutableAllocationFuzz, false, Normal, nullptr) \
    … …  
    560561    v(maximumFunctionForConstructInlineCandidateInstructionCount, maximumFunctionForConstructInlineCandidateBytecoodeCost, SameOption) \
    561562    v(maximumFTLCandidateInstructionCount, maximumFTLCandidateBytecodeCost, SameOption) \
    562     v(maximumInliningCallerSize, maximumInliningCallerBytecodeCost, SameOption)
     563    v(maximumInliningCallerSize, maximumInliningCallerBytecodeCost, SameOption) \
     564    v(validateBCE, validateBoundsCheckElimination, SameOption)
    563565
    564566enum ExperimentalOptionFlags {

  • trunk/Tools/ChangeLog

    r267712 r267726  
     12020-09-28  Mark Lam  <mark.lam@apple.com>
     2
     3        Add Bounds Check Elimination validation for debugging.
     4        https://bugs.webkit.org/show_bug.cgi?id=217055
     5        rdar://69122891
     6
     7        Reviewed by Keith Miller.
     8
     9        Added --validateBCE=true to ftl-no-cjit-validate-sampling-profiler
     10        and ftl-eager-no-cjit.
     11
     12        * Scripts/run-jsc-stress-tests:
     13
    1142020-09-28  Matt Lewis  <jlewis3@apple.com>
    215

  • trunk/Tools/Scripts/run-jsc-stress-tests

    r267330 r267726  
    11#!/usr/bin/env ruby
    22
    3 # Copyright (C) 2013-2016 Apple Inc. All rights reserved.
     3# Copyright (C) 2013-2020 Apple Inc. All rights reserved.
    44#
    55# Redistribution and use in source and binary forms, with or without
    … …  
    755755
    756756def runFTLNoCJITValidate(*optionalTestSpecificOptions)
    757     run("ftl-no-cjit-validate-sampling-profiler", "--validateGraph=true", "--useSamplingProfiler=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
     757    run("ftl-no-cjit-validate-sampling-profiler", "--validateGraph=true", "--validateBCE=true", "--useSamplingProfiler=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
    758758end
    759759
    … …  
    788788
    789789def runFTLEagerNoCJITValidate(*optionalTestSpecificOptions)
    790     run("ftl-eager-no-cjit", "--validateGraph=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + FORCE_LLINT_EXIT_OPTIONS + optionalTestSpecificOptions))
     790    run("ftl-eager-no-cjit", "--validateGraph=true", "--validateBCE=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + FORCE_LLINT_EXIT_OPTIONS + optionalTestSpecificOptions))
    791791end
    792792
Note: See TracChangeset for help on using the changeset viewer.