Changeset 279598 in webkit


Ignore:
Timestamp:
Jul 6, 2021, 10:59:46 AM (4 years ago)
Author:
Ruben Turcios
Message:

Cherry-pick r279560. rdar://problem/80212160

ActiveScratchBufferScope should take the buffer as argument
​https://bugs.webkit.org/show_bug.cgi?id=227670
rdar://80011612

Reviewed by Mark Lam.

​https://bugs.webkit.org/show_bug.cgi?id=227013 created ActiveScratchBufferScope.
It is used by operations that can cause the GC to run, to mark as roots the contents of the scratch buffer that is live during that time (if any).
The bug is that it simply asks the VM for a scratch buffer of the right size, but this will always return the last scratch buffer, and not necessarily the one that the operation is actually using.

A fairly simple fix is to pass it directly the scratch buffer, since the operation normally can get it easily enough.
In most cases the operation has access to the m_buffer field of the ScratchBuffer, but getting a pointer to the entire structure from that is fairly simple (I added ScratchBuffer::fromData() to do so).

  • dfg/DFGOSRExit.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
  • dfg/DFGOSRExit.h:
  • dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileNewArray):
  • dfg/DFGThunks.cpp: (JSC::DFG::osrExitGenerationThunkGenerator):
  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::haveABadTime):
  • runtime/VM.h: (JSC::ScratchBuffer::fromData):
  • runtime/VMInlines.h: (JSC::ActiveScratchBufferScope::ActiveScratchBufferScope): (JSC::ActiveScratchBufferScope::~ActiveScratchBufferScope):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@279560 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-612.1.22.3-branch/Source/JavaScriptCore
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/ChangeLog

    r279436 r279598  
     12021-07-06  Ruben Turcios  <rubent_22@apple.com>
     2
     3        Cherry-pick r279560. rdar://problem/80212160
     4
     5    ActiveScratchBufferScope should take the buffer as argument
     6    https://bugs.webkit.org/show_bug.cgi?id=227670
     7    rdar://80011612
     8   
     9    Reviewed by Mark Lam.
     10   
     11    https://bugs.webkit.org/show_bug.cgi?id=227013 created ActiveScratchBufferScope.
     12    It is used by operations that can cause the GC to run, to mark as roots the contents of the scratch buffer that is live during that time (if any).
     13    The bug is that it simply asks the VM for a scratch buffer of the right size, but this will always return the last scratch buffer, and not necessarily the one that the operation is actually using.
     14   
     15    A fairly simple fix is to pass it directly the scratch buffer, since the operation normally can get it easily enough.
     16    In most cases the operation has access to the m_buffer field of the ScratchBuffer, but getting a pointer to the entire structure from that is fairly simple (I added ScratchBuffer::fromData() to do so).
     17   
     18    * dfg/DFGOSRExit.cpp:
     19    (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
     20    * dfg/DFGOSRExit.h:
     21    * dfg/DFGOperations.cpp:
     22    (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
     23    * dfg/DFGSpeculativeJIT.cpp:
     24    (JSC::DFG::SpeculativeJIT::compileNewArray):
     25    * dfg/DFGThunks.cpp:
     26    (JSC::DFG::osrExitGenerationThunkGenerator):
     27    * runtime/JSGlobalObject.cpp:
     28    (JSC::JSGlobalObject::haveABadTime):
     29    * runtime/VM.h:
     30    (JSC::ScratchBuffer::fromData):
     31    * runtime/VMInlines.h:
     32    (JSC::ActiveScratchBufferScope::ActiveScratchBufferScope):
     33    (JSC::ActiveScratchBufferScope::~ActiveScratchBufferScope):
     34   
     35   
     36    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279560 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     37
     38    2021-07-04  Robin Morisset  <rmorisset@apple.com>
     39
     40            ActiveScratchBufferScope should take the buffer as argument
     41            https://bugs.webkit.org/show_bug.cgi?id=227670
     42            rdar://80011612
     43
     44            Reviewed by Mark Lam.
     45
     46            https://bugs.webkit.org/show_bug.cgi?id=227013 created ActiveScratchBufferScope.
     47            It is used by operations that can cause the GC to run, to mark as roots the contents of the scratch buffer that is live during that time (if any).
     48            The bug is that it simply asks the VM for a scratch buffer of the right size, but this will always return the last scratch buffer, and not necessarily the one that the operation is actually using.
     49
     50            A fairly simple fix is to pass it directly the scratch buffer, since the operation normally can get it easily enough.
     51            In most cases the operation has access to the m_buffer field of the ScratchBuffer, but getting a pointer to the entire structure from that is fairly simple (I added ScratchBuffer::fromData() to do so).
     52
     53            * dfg/DFGOSRExit.cpp:
     54            (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
     55            * dfg/DFGOSRExit.h:
     56            * dfg/DFGOperations.cpp:
     57            (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
     58            * dfg/DFGSpeculativeJIT.cpp:
     59            (JSC::DFG::SpeculativeJIT::compileNewArray):
     60            * dfg/DFGThunks.cpp:
     61            (JSC::DFG::osrExitGenerationThunkGenerator):
     62            * runtime/JSGlobalObject.cpp:
     63            (JSC::JSGlobalObject::haveABadTime):
     64            * runtime/VM.h:
     65            (JSC::ScratchBuffer::fromData):
     66            * runtime/VMInlines.h:
     67            (JSC::ActiveScratchBufferScope::ActiveScratchBufferScope):
     68            (JSC::ActiveScratchBufferScope::~ActiveScratchBufferScope):
     69
    1702021-06-30  Alan Coon  <alancoon@apple.com>
    271

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/dfg/DFGOSRExit.cpp

    r279256 r279598  
    142142}
    143143
    144 JSC_DEFINE_JIT_OPERATION(operationCompileOSRExit, void, (CallFrame* callFrame))
     144JSC_DEFINE_JIT_OPERATION(operationCompileOSRExit, void, (CallFrame* callFrame, void* bufferToPreserve))
    145145{
    146146    VM& vm = callFrame->deprecatedVM();
    147147    auto scope = DECLARE_THROW_SCOPE(vm);
    148     ActiveScratchBufferScope activeScratchBufferScope(vm, GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters);
     148    ActiveScratchBufferScope activeScratchBufferScope(ScratchBuffer::fromData(bufferToPreserve), GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters);
    149149
    150150    if constexpr (validateDFGDoesGC) {
    … …  
    931931    VM& vm = callFrame->deprecatedVM();
    932932    NativeCallFrameTracer tracer(vm, callFrame);
    933     ActiveScratchBufferScope activeScratchBufferScope(vm, GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters);
     933    ActiveScratchBufferScope activeScratchBufferScope(ScratchBuffer::fromData(scratch), GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters);
    934934
    935935    SpeculationFailureDebugInfo* debugInfo = static_cast<SpeculationFailureDebugInfo*>(debugInfoRaw);

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/dfg/DFGOSRExit.h

    r274024 r279598  
    139139};
    140140
    141 JSC_DECLARE_JIT_OPERATION(operationCompileOSRExit, void, (CallFrame*));
     141JSC_DECLARE_JIT_OPERATION(operationCompileOSRExit, void, (CallFrame*, void*));
    142142JSC_DECLARE_JIT_OPERATION(operationDebugPrintSpeculationFailure, void, (CallFrame*, void*, void*));
    143143JSC_DECLARE_JIT_OPERATION(operationMaterializeOSRExitSideState, void, (VM*, const OSRExitBase*, EncodedJSValue*));
    … …  
    150150    OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, SpeculativeJIT*, unsigned streamIndex, unsigned recoveryIndex = UINT_MAX);
    151151
    152     friend void JIT_OPERATION_ATTRIBUTES operationCompileOSRExit(CallFrame*);
     152    friend void JIT_OPERATION_ATTRIBUTES operationCompileOSRExit(CallFrame*, void*);
    153153
    154154    CodeLocationLabel<JSInternalPtrTag> m_patchableJumpLocation;

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r278875 r279598  
    10401040    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
    10411041    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    1042     ActiveScratchBufferScope activeScratchBufferScope(vm, elementCount);
    1043     auto scope = DECLARE_THROW_SCOPE(vm);
     1042    ActiveScratchBufferScope activeScratchBufferScope(ScratchBuffer::fromData(buffer), elementCount);
     1043    auto scope = DECLARE_THROW_SCOPE(vm);
     1044
    10441045
    10451046    // We assume that multiple JSArray::push calls with ArrayWithInt32/ArrayWithContiguous do not cause JS traps.
    … …  
    17351736    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
    17361737    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    1737     ActiveScratchBufferScope activeScratchBufferScope(vm, size);
     1738    ActiveScratchBufferScope activeScratchBufferScope(ScratchBuffer::fromData(buffer), size);
    17381739
    17391740    return bitwise_cast<char*>(constructArray(globalObject, arrayStructure, static_cast<JSValue*>(buffer), size));
    … …  
    30433044    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
    30443045    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    3045     ActiveScratchBufferScope activeScratchBufferScope(vm, numItems);
     3046    ActiveScratchBufferScope activeScratchBufferScope(ScratchBuffer::fromData(buffer), numItems);
    30463047    auto scope = DECLARE_THROW_SCOPE(vm);
    30473048

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r279216 r279598  
    92399239
    92409240    GPRFlushedCallResult result(this);
     9241    GPRReg resultGPR = result.gpr();
    92419242
    92429243    callOperation(
    9243         operationNewArray, result.gpr(), TrustedImmPtr::weakPointer(m_graph, globalObject), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
     9244        operationNewArray, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
    92449245        static_cast<void*>(buffer), size_t(node->numChildren()));
    92459246    m_jit.exceptionCheck();
    92469247
    9247     cellResult(result.gpr(), node, UseChildrenCalledExplicitly);
     9248    cellResult(resultGPR, node, UseChildrenCalledExplicitly);
    92489249}
    92499250

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/dfg/DFGThunks.cpp

    r279256 r279598  
    9090    storeSpooler.finalizeFPR();
    9191
    92     // Set up one argument.
    93     jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
     92    // This will implicitly pass GPRInfo::callFrameRegister as the first argument based on the operation type.
     93    jit.setupArguments<decltype(operationCompileOSRExit)>(bufferGPR);
    9494    jit.prepareCallOperation(vm);
    9595

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/runtime/VM.h

    r279216 r279598  
    261261    }
    262262
     263    static ScratchBuffer* fromData(void* buffer)
     264    {
     265        return bitwise_cast<ScratchBuffer*>(static_cast<char*>(buffer) - OBJECT_OFFSETOF(ScratchBuffer, m_buffer));
     266    }
     267
    263268    static size_t allocationSize(Checked<size_t> bufferSize) { return sizeof(ScratchBuffer) + bufferSize; }
    264269    void setActiveLength(size_t activeLength) { u.m_activeLength = activeLength; }
    … …  
    283288class ActiveScratchBufferScope {
    284289public:
    285     ActiveScratchBufferScope(VM&, size_t activeScratchBufferSizeInJSValues);
     290    ActiveScratchBufferScope(ScratchBuffer*, size_t activeScratchBufferSizeInJSValues);
    286291    ~ActiveScratchBufferScope();
    287292

  • branches/safari-612.1.22.3-branch/Source/JavaScriptCore/runtime/VMInlines.h

    r278875 r279598  
    3333namespace JSC {
    3434
    35 inline ActiveScratchBufferScope::ActiveScratchBufferScope(VM& vm, size_t activeScratchBufferSizeInJSValues)
    36     : m_scratchBuffer(vm.scratchBufferForSize(activeScratchBufferSizeInJSValues * sizeof(EncodedJSValue)))
     35inline ActiveScratchBufferScope::ActiveScratchBufferScope(ScratchBuffer* buffer, size_t activeScratchBufferSizeInJSValues)
     36    : m_scratchBuffer(buffer)
    3737{
    3838    // Tell GC mark phase how much of the scratch buffer is active during the call operation this scope is used in.
    3939    if (m_scratchBuffer)
    40         m_scratchBuffer->u.m_activeLength = activeScratchBufferSizeInJSValues * sizeof(EncodedJSValue);
     40        m_scratchBuffer->setActiveLength(activeScratchBufferSizeInJSValues * sizeof(EncodedJSValue));
    4141}
    4242
    … …  
    4545    // Tell the GC that we're not using the scratch buffer anymore.
    4646    if (m_scratchBuffer)
    47         m_scratchBuffer->u.m_activeLength = 0;
     47        m_scratchBuffer->setActiveLength(0);
    4848}
    4949
Note: See TracChangeset for help on using the changeset viewer.