Changeset 168776 in webkit


Ignore:
Timestamp:
May 13, 2014 8:57:18 PM (10 years ago)
Author:
fpizlo@apple.com
Message:

JIT breakpoints should be more informative
​https://bugs.webkit.org/show_bug.cgi?id=132882

Reviewed by Oliver Hunt.

Introduce the notion of an AbortReason, which is a nice enumeration of coded assertion
failure names. This means that all you need to figure out why the JIT SIGTRAP'd is to look
at that platform's abort reason register (r11 on X86-64 for example).

  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • assembler/AbortReason.h: Added.
  • assembler/AbstractMacroAssembler.h:
  • assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::abortWithReason):

  • assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::abortWithReason):

  • assembler/MacroAssemblerX86.h:

(JSC::MacroAssemblerX86::abortWithReason):

  • assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::abortWithReason):

  • dfg/DFGSlowPathGenerator.h:

(JSC::DFG::SlowPathGenerator::generate):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::bail):
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
(JSC::DFG::SpeculativeJIT::compileMakeRope):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGThunks.cpp:

(JSC::DFG::osrEntryThunkGenerator):

  • jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::jitAssertIsInt32):
(JSC::AssemblyHelpers::jitAssertIsJSInt32):
(JSC::AssemblyHelpers::jitAssertIsJSNumber):
(JSC::AssemblyHelpers::jitAssertIsJSDouble):
(JSC::AssemblyHelpers::jitAssertIsCell):
(JSC::AssemblyHelpers::jitAssertTagsInPlace):
(JSC::AssemblyHelpers::jitAssertHasValidCallFrame):
(JSC::AssemblyHelpers::jitAssertIsNull):
(JSC::AssemblyHelpers::jitAssertArgumentCountSane):
(JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):

  • jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::checkStackPointerAlignment):
(JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo): Deleted.

  • jit/JIT.h:
  • jit/JITArithmetic.cpp:

(JSC::JIT::emitSlow_op_div):

  • jit/JITOpcodes.cpp:

(JSC::JIT::emitSlow_op_loop_hint):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTINativeCall):

  • jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::compileGetDirectOffset):
(JSC::JIT::addStructureTransitionCheck): Deleted.
(JSC::JIT::testPrototype): Deleted.

  • jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::compileGetDirectOffset):

  • jit/RegisterPreservationWrapperGenerator.cpp:

(JSC::generateRegisterRestoration):

  • jit/Repatch.cpp:

(JSC::addStructureTransitionCheck):
(JSC::linkClosureCall):

  • jit/ThunkGenerators.cpp:

(JSC::emitPointerValidation):
(JSC::nativeForGenerator):

  • yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generate):

Location:
trunk/Source/JavaScriptCore
Files:
1 added
26 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r168729 r168776  
     12014-05-13  Filip Pizlo  <fpizlo@apple.com>
     2
     3        JIT breakpoints should be more informative
     4        https://bugs.webkit.org/show_bug.cgi?id=132882
     5
     6        Reviewed by Oliver Hunt.
     7       
     8        Introduce the notion of an AbortReason, which is a nice enumeration of coded assertion
     9        failure names. This means that all you need to figure out why the JIT SIGTRAP'd is to look
     10        at that platform's abort reason register (r11 on X86-64 for example).
     11
     12        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
     13        * JavaScriptCore.xcodeproj/project.pbxproj:
     14        * assembler/AbortReason.h: Added.
     15        * assembler/AbstractMacroAssembler.h:
     16        * assembler/MacroAssemblerARM64.h:
     17        (JSC::MacroAssemblerARM64::abortWithReason):
     18        * assembler/MacroAssemblerARMv7.h:
     19        (JSC::MacroAssemblerARMv7::abortWithReason):
     20        * assembler/MacroAssemblerX86.h:
     21        (JSC::MacroAssemblerX86::abortWithReason):
     22        * assembler/MacroAssemblerX86_64.h:
     23        (JSC::MacroAssemblerX86_64::abortWithReason):
     24        * dfg/DFGSlowPathGenerator.h:
     25        (JSC::DFG::SlowPathGenerator::generate):
     26        * dfg/DFGSpeculativeJIT.cpp:
     27        (JSC::DFG::SpeculativeJIT::bail):
     28        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
     29        (JSC::DFG::SpeculativeJIT::compileMakeRope):
     30        * dfg/DFGSpeculativeJIT.h:
     31        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
     32        * dfg/DFGSpeculativeJIT32_64.cpp:
     33        (JSC::DFG::SpeculativeJIT::compile):
     34        * dfg/DFGSpeculativeJIT64.cpp:
     35        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
     36        (JSC::DFG::SpeculativeJIT::compile):
     37        * dfg/DFGThunks.cpp:
     38        (JSC::DFG::osrEntryThunkGenerator):
     39        * jit/AssemblyHelpers.cpp:
     40        (JSC::AssemblyHelpers::jitAssertIsInt32):
     41        (JSC::AssemblyHelpers::jitAssertIsJSInt32):
     42        (JSC::AssemblyHelpers::jitAssertIsJSNumber):
     43        (JSC::AssemblyHelpers::jitAssertIsJSDouble):
     44        (JSC::AssemblyHelpers::jitAssertIsCell):
     45        (JSC::AssemblyHelpers::jitAssertTagsInPlace):
     46        (JSC::AssemblyHelpers::jitAssertHasValidCallFrame):
     47        (JSC::AssemblyHelpers::jitAssertIsNull):
     48        (JSC::AssemblyHelpers::jitAssertArgumentCountSane):
     49        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
     50        * jit/AssemblyHelpers.h:
     51        (JSC::AssemblyHelpers::checkStackPointerAlignment):
     52        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo): Deleted.
     53        * jit/JIT.h:
     54        * jit/JITArithmetic.cpp:
     55        (JSC::JIT::emitSlow_op_div):
     56        * jit/JITOpcodes.cpp:
     57        (JSC::JIT::emitSlow_op_loop_hint):
     58        * jit/JITOpcodes32_64.cpp:
     59        (JSC::JIT::privateCompileCTINativeCall):
     60        * jit/JITPropertyAccess.cpp:
     61        (JSC::JIT::emit_op_get_by_val):
     62        (JSC::JIT::compileGetDirectOffset):
     63        (JSC::JIT::addStructureTransitionCheck): Deleted.
     64        (JSC::JIT::testPrototype): Deleted.
     65        * jit/JITPropertyAccess32_64.cpp:
     66        (JSC::JIT::emit_op_get_by_val):
     67        (JSC::JIT::compileGetDirectOffset):
     68        * jit/RegisterPreservationWrapperGenerator.cpp:
     69        (JSC::generateRegisterRestoration):
     70        * jit/Repatch.cpp:
     71        (JSC::addStructureTransitionCheck):
     72        (JSC::linkClosureCall):
     73        * jit/ThunkGenerators.cpp:
     74        (JSC::emitPointerValidation):
     75        (JSC::nativeForGenerator):
     76        * yarr/YarrJIT.cpp:
     77        (JSC::Yarr::YarrGenerator::generate):
     78
    1792014-05-13  peavo@outlook.com  <peavo@outlook.com>
    280

  • trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj

    r168178 r168776  
    819819    <ClInclude Include="..\API\OpaqueJSString.h" />
    820820    <ClInclude Include="..\API\WebKitAvailability.h" />
     821    <ClInclude Include="..\assembler\AbortReason.h" />
    821822    <ClInclude Include="..\assembler\AbstractMacroAssembler.h" />
    822823    <ClInclude Include="..\assembler\AssemblerBuffer.h" />

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r168443 r168776  
    108108                0F1E3A471534CBB9000F9456 /* DFGDoubleFormatState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */; settings = {ATTRIBUTES = (Private, ); }; };
    109109                0F1E3A67153A21E2000F9456 /* DFGSilentRegisterSavePlan.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A65153A21DF000F9456 /* DFGSilentRegisterSavePlan.h */; settings = {ATTRIBUTES = (Private, ); }; };
     110                0F1FE51C1922A3BC006987C5 /* AbortReason.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1FE51B1922A3BC006987C5 /* AbortReason.h */; settings = {ATTRIBUTES = (Private, ); }; };
    110111                0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
    111112                0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */; settings = {ATTRIBUTES = (Private, ); }; };
    … …  
    19151916                0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSlowPathGenerator.h; path = dfg/DFGSlowPathGenerator.h; sourceTree = "<group>"; };
    19161917                0F1E3A65153A21DF000F9456 /* DFGSilentRegisterSavePlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSilentRegisterSavePlan.h; path = dfg/DFGSilentRegisterSavePlan.h; sourceTree = "<group>"; };
     1918                0F1FE51B1922A3BC006987C5 /* AbortReason.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbortReason.h; sourceTree = "<group>"; };
    19171919                0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeSpecializationKind.h; sourceTree = "<group>"; };
    19181920                0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeConventions.h; sourceTree = "<group>"; };
    … …  
    48974899                        isa = PBXGroup;
    48984900                        children = (
     4901                                0F1FE51B1922A3BC006987C5 /* AbortReason.h */,
    48994902                                860161DF0F3A83C100F84710 /* AbstractMacroAssembler.h */,
    49004903                                8640923B156EED3B00566CB2 /* ARM64Assembler.h */,
    … …  
    58265829                                A532439418569709002ED692 /* generate-combined-inspector-json.py in Headers */,
    58275830                                0F2B66E017B6B5AB00A7AE3F /* GenericTypedArrayView.h in Headers */,
     5831                                0F1FE51C1922A3BC006987C5 /* AbortReason.h in Headers */,
    58285832                                0F2B66E117B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h in Headers */,
    58295833                                0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */,

  • trunk/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h

    r165842 r168776  
    11/*
    2  * Copyright (C) 2008, 2012 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008, 2012, 2014 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2727#define AbstractMacroAssembler_h
    2828
     29#include "AbortReason.h"
    2930#include "AssemblerBuffer.h"
    3031#include "CodeLocation.h"

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h

    r168729 r168776  
    11/*
    2  * Copyright (C) 2012 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    807807    }
    808808
     809    void abortWithReason(AbortReason reason)
     810    {
     811        move(TrustedImm32(reason), dataTempRegister);
     812        breakpoint();
     813    }
     814
    809815    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
    810816    {

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h

    r168729 r168776  
    11/*
    2  * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009, 2010, 2014 Apple Inc. All rights reserved.
    33 * Copyright (C) 2010 University of Szeged
    44 *
    … …  
    633633    }
    634634   
     635    void abortWithReason(AbortReason reason)
     636    {
     637        move(TrustedImm32(reason), dataTempRegister);
     638        breakpoint();
     639    }
     640
    635641    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
    636642    {

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86.h

    r168729 r168776  
    11/*
    2  * Copyright (C) 2008 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008, 2014 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    112112    }
    113113
     114    void abortWithReason(AbortReason reason)
     115    {
     116        move(TrustedImm32(reason), X86Registers::eax);
     117        breakpoint();
     118    }
     119
    114120    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
    115121    {

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h

    r165366 r168776  
    11/*
    2  * Copyright (C) 2008, 2012 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008, 2012, 2014 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    628628        neg64(srcDest);
    629629        return Jump(m_assembler.jCC(x86Condition(cond)));
     630    }
     631
     632    void abortWithReason(AbortReason reason)
     633    {
     634        move(TrustedImm32(reason), X86Registers::r11);
     635        breakpoint();
    630636    }
    631637

  • trunk/Source/JavaScriptCore/dfg/DFGSlowPathGenerator.h

    r164424 r168776  
    5151        generateInternal(jit);
    5252        if (!ASSERT_DISABLED)
    53             jit->m_jit.breakpoint(); // make sure that the generator jumps back to somewhere
     53            jit->m_jit.abortWithReason(DFGSlowPathGeneratorFellThrough);
    5454    }
    5555    MacroAssembler::Label label() const { return m_label; }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r168729 r168776  
    13421342{
    13431343    m_compileOkay = true;
    1344     m_jit.breakpoint();
     1344    m_jit.abortWithReason(DFGBailed);
    13451345    clearGenerationInfo();
    13461346}
    … …  
    13611361        // But to be sure that nobody has generated a jump to this block, drop in a
    13621362        // breakpoint here.
    1363         m_jit.breakpoint();
     1363        m_jit.abortWithReason(DFGUnreachableBasicBlock);
    13641364        return;
    13651365    }
    … …  
    28222822        JITCompiler::Jump ok = m_jit.branch32(
    28232823            JITCompiler::GreaterThanOrEqual, allocatorGPR, TrustedImm32(0));
    2824         m_jit.breakpoint();
     2824        m_jit.abortWithReason(DFGNegativeStringLength);
    28252825        ok.link(&m_jit);
    28262826    }
    … …  
    28382838        JITCompiler::Jump ok = m_jit.branch32(
    28392839            JITCompiler::GreaterThanOrEqual, allocatorGPR, TrustedImm32(0));
    2840         m_jit.breakpoint();
     2840        m_jit.abortWithReason(DFGNegativeStringLength);
    28412841        ok.link(&m_jit);
    28422842    }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r168443 r168776  
    21442144        m_jit.move(size, resultGPR);
    21452145        MacroAssembler::Jump nonZeroSize = m_jit.branchTest32(MacroAssembler::NonZero, resultGPR);
    2146         m_jit.breakpoint();
     2146        m_jit.abortWithReason(DFGBasicStorageAllocatorZeroSize);
    21472147        nonZeroSize.link(&m_jit);
    21482148#endif

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r168729 r168776  
    37103710        SpeculateCellOperand op1(this, node->child1());
    37113711        JITCompiler::Jump isOK = m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(op1.gpr(), JSCell::structureIDOffset()), TrustedImmPtr(node->structure()));
    3712         m_jit.breakpoint();
     3712        m_jit.abortWithReason(DFGIneffectiveWatchpoint);
    37133713        isOK.link(&m_jit);
    37143714#else

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r168443 r168776  
    10371037        if (!ASSERT_DISABLED) {
    10381038            MacroAssembler::Jump checkCell = branchIsCell(JSValueRegs(gpr));
    1039             m_jit.breakpoint();
     1039            m_jit.abortWithReason(DFGIsNotCell);
    10401040            checkCell.link(&m_jit);
    10411041        }
    … …  
    37833783            JITCompiler::Address(op1.gpr(), JSCell::structureIDOffset()),
    37843784            node->structure());
    3785         m_jit.breakpoint();
     3785        m_jit.abortWithReason(DFGIneffectiveWatchpoint);
    37863786        isOK.link(&m_jit);
    37873787#else

  • trunk/Source/JavaScriptCore/dfg/DFGThunks.cpp

    r164229 r168776  
    128128    jit.loadPtr(MacroAssembler::Address(GPRInfo::regT0, offsetOfTargetPC), GPRInfo::regT1);
    129129    MacroAssembler::Jump ok = jit.branchPtr(MacroAssembler::Above, GPRInfo::regT1, MacroAssembler::TrustedImmPtr(bitwise_cast<void*>(static_cast<intptr_t>(1000))));
    130     jit.breakpoint();
     130    jit.abortWithReason(DFGUnreasonableOSREntryJumpDestination);
    131131    ok.link(&jit);
    132132    jit.jump(GPRInfo::regT1);

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

    r168729 r168776  
    8585#if CPU(X86_64)
    8686    Jump checkInt32 = branch64(BelowOrEqual, gpr, TrustedImm64(static_cast<uintptr_t>(0xFFFFFFFFu)));
    87     breakpoint();
     87    abortWithReason(AHIsNotInt32);
    8888    checkInt32.link(this);
    8989#else
    … …  
    9595{
    9696    Jump checkJSInt32 = branch64(AboveOrEqual, gpr, GPRInfo::tagTypeNumberRegister);
    97     breakpoint();
     97    abortWithReason(AHIsNotJSInt32);
    9898    checkJSInt32.link(this);
    9999}
    … …  
    102102{
    103103    Jump checkJSNumber = branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagTypeNumberRegister);
    104     breakpoint();
     104    abortWithReason(AHIsNotJSNumber);
    105105    checkJSNumber.link(this);
    106106}
    … …  
    111111    Jump checkJSNumber = branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagTypeNumberRegister);
    112112    checkJSInt32.link(this);
    113     breakpoint();
     113    abortWithReason(AHIsNotJSDouble);
    114114    checkJSNumber.link(this);
    115115}
    … …  
    118118{
    119119    Jump checkCell = branchTest64(MacroAssembler::Zero, gpr, GPRInfo::tagMaskRegister);
    120     breakpoint();
     120    abortWithReason(AHIsNotCell);
    121121    checkCell.link(this);
    122122}
    … …  
    125125{
    126126    Jump ok = branch64(Equal, GPRInfo::tagTypeNumberRegister, TrustedImm64(TagTypeNumber));
     127    abortWithReason(AHTagTypeNumberNotInPlace);
    127128    breakpoint();
    128129    ok.link(this);
    129130   
    130131    ok = branch64(Equal, GPRInfo::tagMaskRegister, TrustedImm64(TagMask));
    131     breakpoint();
     132    abortWithReason(AHTagMaskNotInPlace);
    132133    ok.link(this);
    133134}
    … …  
    141142{
    142143    Jump checkJSInt32 = branch32(Equal, gpr, TrustedImm32(JSValue::Int32Tag));
    143     breakpoint();
     144    abortWithReason(AHIsNotJSInt32);
    144145    checkJSInt32.link(this);
    145146}
    … …  
    149150    Jump checkJSInt32 = branch32(Equal, gpr, TrustedImm32(JSValue::Int32Tag));
    150151    Jump checkJSDouble = branch32(Below, gpr, TrustedImm32(JSValue::LowestTag));
    151     breakpoint();
     152    abortWithReason(AHIsNotJSNumber);
    152153    checkJSInt32.link(this);
    153154    checkJSDouble.link(this);
    … …  
    157158{
    158159    Jump checkJSDouble = branch32(Below, gpr, TrustedImm32(JSValue::LowestTag));
    159     breakpoint();
     160    abortWithReason(AHIsNotJSDouble);
    160161    checkJSDouble.link(this);
    161162}
    … …  
    164165{
    165166    Jump checkCell = branch32(Equal, gpr, TrustedImm32(JSValue::CellTag));
    166     breakpoint();
     167    abortWithReason(AHIsNotCell);
    167168    checkCell.link(this);
    168169}
    … …  
    176177{
    177178    Jump checkCFR = branchTestPtr(Zero, GPRInfo::callFrameRegister, TrustedImm32(7));
    178     breakpoint();
     179    abortWithReason(AHCallFrameMisaligned);
    179180    checkCFR.link(this);
    180181}
    … …  
    183184{
    184185    Jump checkNull = branchTestPtr(Zero, gpr);
    185     breakpoint();
     186    abortWithReason(AHIsNotNull);
    186187    checkNull.link(this);
    187188}
    … …  
    190191{
    191192    Jump ok = branch32(Below, payloadFor(JSStack::ArgumentCount), TrustedImm32(10000000));
    192     breakpoint();
     193    abortWithReason(AHInsaneArgumentCount);
    193194    ok.link(this);
    194195}
    195196#endif // !ASSERT_DISABLED
    196197
     198void AssemblyHelpers::emitStoreStructureWithTypeInfo(AssemblyHelpers& jit, TrustedImmPtr structure, RegisterID dest)
     199{
     200    const Structure* structurePtr = static_cast<const Structure*>(structure.m_value);
     201#if USE(JSVALUE64)
     202    jit.store64(TrustedImm64(structurePtr->idBlob()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));
     203    if (!ASSERT_DISABLED) {
     204        Jump correctStructure = jit.branch32(Equal, MacroAssembler::Address(dest, JSCell::structureIDOffset()), TrustedImm32(structurePtr->id()));
     205        jit.abortWithReason(AHStructureIDIsValid);
     206        correctStructure.link(&jit);
     207
     208        Jump correctIndexingType = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::indexingTypeOffset()), TrustedImm32(structurePtr->indexingType()));
     209        jit.abortWithReason(AHIndexingTypeIsValid);
     210        correctIndexingType.link(&jit);
     211
     212        Jump correctType = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::typeInfoTypeOffset()), TrustedImm32(structurePtr->typeInfo().type()));
     213        jit.abortWithReason(AHTypeInfoIsValid);
     214        correctType.link(&jit);
     215
     216        Jump correctFlags = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::typeInfoFlagsOffset()), TrustedImm32(structurePtr->typeInfo().inlineTypeFlags()));
     217        jit.abortWithReason(AHTypeInfoInlineTypeFlagsAreValid);
     218        correctFlags.link(&jit);
     219    }
     220#else
     221    // Do a 32-bit wide store to initialize the cell's fields.
     222    jit.store32(TrustedImm32(structurePtr->objectInitializationBlob()), MacroAssembler::Address(dest, JSCell::indexingTypeOffset()));
     223    jit.storePtr(structure, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
     224#endif
     225}
     226
    197227} // namespace JSC
    198228

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

    r167394 r168776  
    6363#if !defined(NDEBUG) && !CPU(ARM64)
    6464        Jump stackPointerAligned = branchTestPtr(Zero, stackPointerRegister, TrustedImm32(0xf));
    65         breakpoint();
     65        abortWithReason(AHStackPointerMisaligned);
    6666        stackPointerAligned.link(this);
    6767#endif
    … …  
    630630    }
    631631
    632     static void emitStoreStructureWithTypeInfo(AssemblyHelpers& jit, TrustedImmPtr structure, RegisterID dest)
    633     {
    634         const Structure* structurePtr = static_cast<const Structure*>(structure.m_value);
    635 #if USE(JSVALUE64)
    636         jit.store64(TrustedImm64(structurePtr->idBlob()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));
    637 #ifndef NDEBUG
    638         Jump correctStructure = jit.branch32(Equal, MacroAssembler::Address(dest, JSCell::structureIDOffset()), TrustedImm32(structurePtr->id()));
    639         jit.breakpoint();
    640         correctStructure.link(&jit);
    641 
    642         Jump correctIndexingType = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::indexingTypeOffset()), TrustedImm32(structurePtr->indexingType()));
    643         jit.breakpoint();
    644         correctIndexingType.link(&jit);
    645 
    646         Jump correctType = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::typeInfoTypeOffset()), TrustedImm32(structurePtr->typeInfo().type()));
    647         jit.breakpoint();
    648         correctType.link(&jit);
    649 
    650         Jump correctFlags = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::typeInfoFlagsOffset()), TrustedImm32(structurePtr->typeInfo().inlineTypeFlags()));
    651         jit.breakpoint();
    652         correctFlags.link(&jit);
    653 #endif
    654 #else
    655         // Do a 32-bit wide store to initialize the cell's fields.
    656         jit.store32(TrustedImm32(structurePtr->objectInitializationBlob()), MacroAssembler::Address(dest, JSCell::indexingTypeOffset()));
    657         jit.storePtr(structure, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
    658 #endif
    659     }
     632    static void emitStoreStructureWithTypeInfo(AssemblyHelpers& jit, TrustedImmPtr structure, RegisterID dest);
    660633
    661634    Jump checkMarkByte(GPRReg cell)

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r166392 r168776  
    306306        void emitLoadInt32ToDouble(int index, FPRegisterID value);
    307307        Jump emitJumpIfCellNotObject(RegisterID cellReg);
    308 
    309         Jump addStructureTransitionCheck(JSCell*, Structure*, StructureStubInfo*, RegisterID scratch);
    310         void addStructureTransitionCheck(JSCell*, Structure*, StructureStubInfo*, JumpList& failureCases, RegisterID scratch);
    311         void testPrototype(JSValue, JumpList& failureCases, StructureStubInfo*);
    312308
    313309        enum WriteBarrierMode { UnconditionalWriteBarrier, ShouldFilterBase, ShouldFilterValue, ShouldFilterBaseAndValue };

  • trunk/Source/JavaScriptCore/jit/JITArithmetic.cpp

    r163844 r168776  
    956956    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
    957957    if (types.first().definitelyIsNumber() && types.second().definitelyIsNumber()) {
    958 #ifndef NDEBUG
    959         breakpoint();
    960 #endif
     958        if (!ASSERT_DISABLED)
     959            abortWithReason(JITDivOperandsAreNotNumbers);
    961960        return;
    962961    }

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r168443 r168776  
    11071107        if (!ASSERT_DISABLED) {
    11081108            Jump ok = branchPtr(MacroAssembler::Above, regT0, TrustedImmPtr(bitwise_cast<void*>(static_cast<intptr_t>(1000))));
    1109             breakpoint();
     1109            abortWithReason(JITUnreasonableLoopHintJumpTarget);
    11101110            ok.link(this);
    11111111        }

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r167646 r168776  
    102102#else
    103103#error "JIT not supported on this platform."
    104     breakpoint();
     104    abortWithReason(JITNotSupported);
    105105#endif // CPU(X86)
    106106

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r168729 r168776  
    140140    Label done = label();
    141141   
    142 #if !ASSERT_DISABLED
    143     Jump resultOK = branchTest64(NonZero, regT0);
    144     breakpoint();
    145     resultOK.link(this);
    146 #endif
     142    if (!ASSERT_DISABLED) {
     143        Jump resultOK = branchTest64(NonZero, regT0);
     144        abortWithReason(JITGetByValResultIsNotEmpty);
     145        resultOK.link(this);
     146    }
    147147
    148148    emitValueProfilingSite();
    … …  
    253253        done.link(this);
    254254    } else {
    255 #if !ASSERT_DISABLED
    256         Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(firstOutOfLineOffset));
    257         breakpoint();
    258         isOutOfLine.link(this);
    259 #endif
     255        if (!ASSERT_DISABLED) {
     256            Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(firstOutOfLineOffset));
     257            abortWithReason(JITOffsetIsNotOutOfLine);
     258            isOutOfLine.link(this);
     259        }
    260260        loadPtr(Address(base, JSObject::butterflyOffset()), scratch);
    261261        neg32(offset);
    … …  
    975975    UNUSED_PARAM(owner);
    976976#endif // ENABLE(GGC)
    977 }
    978 
    979 JIT::Jump JIT::addStructureTransitionCheck(JSCell* object, Structure* structure, StructureStubInfo* stubInfo, RegisterID scratch)
    980 {
    981     if (object->structure() == structure && structure->transitionWatchpointSetIsStillValid()) {
    982         structure->addTransitionWatchpoint(stubInfo->addWatchpoint(m_codeBlock));
    983 #if !ASSERT_DISABLED
    984         move(TrustedImmPtr(object), scratch);
    985         Jump ok = branchStructure(Equal, Address(scratch, JSCell::structureIDOffset()), structure);
    986         breakpoint();
    987         ok.link(this);
    988 #endif
    989         Jump result; // Returning an unset jump this way because otherwise VC++ would complain.
    990         return result;
    991     }
    992    
    993     move(TrustedImmPtr(object), scratch);
    994     return branchStructure(NotEqual, Address(scratch, JSCell::structureIDOffset()), structure);
    995 }
    996 
    997 void JIT::addStructureTransitionCheck(JSCell* object, Structure* structure, StructureStubInfo* stubInfo, JumpList& failureCases, RegisterID scratch)
    998 {
    999     Jump failureCase = addStructureTransitionCheck(object, structure, stubInfo, scratch);
    1000     if (!failureCase.isSet())
    1001         return;
    1002    
    1003     failureCases.append(failureCase);
    1004 }
    1005 
    1006 void JIT::testPrototype(JSValue prototype, JumpList& failureCases, StructureStubInfo* stubInfo)
    1007 {
    1008     if (prototype.isNull())
    1009         return;
    1010 
    1011     ASSERT(prototype.isCell());
    1012     addStructureTransitionCheck(prototype.asCell(), prototype.asCell()->structure(), stubInfo, failureCases, regT3);
    1013977}
    1014978

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp

    r168443 r168776  
    162162    Label done = label();
    163163
    164 #if !ASSERT_DISABLED
    165     Jump resultOK = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
    166     breakpoint();
    167     resultOK.link(this);
    168 #endif
     164    if (!ASSERT_DISABLED) {
     165        Jump resultOK = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
     166        abortWithReason(JITGetByValResultIsNotEmpty);
     167        resultOK.link(this);
     168    }
    169169
    170170    emitValueProfilingSite();
    … …  
    602602        done.link(this);
    603603    } else {
    604 #if !ASSERT_DISABLED
    605         Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(firstOutOfLineOffset));
    606         breakpoint();
    607         isOutOfLine.link(this);
    608 #endif
     604        if (!ASSERT_DISABLED) {
     605            Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(firstOutOfLineOffset));
     606            abortWithReason(JITOffsetIsNotOutOfLine);
     607            isOutOfLine.link(this);
     608        }
    609609        loadPtr(Address(base, JSObject::butterflyOffset()), base);
    610610        neg32(offset);

  • trunk/Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.cpp

    r164241 r168776  
    212212        AssemblyHelpers::Jump ok = jit.branchPtr(
    213213            AssemblyHelpers::Above, GPRInfo::regT1, AssemblyHelpers::TrustedImmPtr(static_cast<size_t>(0x1000)));
    214         jit.breakpoint();
     214        jit.abortWithReason(RPWUnreasonableJumpTarget);
    215215        ok.link(&jit);
    216216    }

  • trunk/Source/JavaScriptCore/jit/Repatch.cpp

    r168548 r168776  
    133133    if (object->structure() == structure && structure->transitionWatchpointSetIsStillValid()) {
    134134        structure->addTransitionWatchpoint(stubInfo.addWatchpoint(codeBlock));
    135 #if !ASSERT_DISABLED
    136         // If we execute this code, the object must have the structure we expect. Assert
    137         // this in debug modes.
    138         jit.move(MacroAssembler::TrustedImmPtr(object), scratchGPR);
    139         MacroAssembler::Jump ok = branchStructure(jit,
    140             MacroAssembler::Equal,
    141             MacroAssembler::Address(scratchGPR, JSCell::structureIDOffset()),
    142             structure);
    143         jit.breakpoint();
    144         ok.link(&jit);
    145 #endif
     135        if (!ASSERT_DISABLED) {
     136            // If we execute this code, the object must have the structure we expect. Assert
     137            // this in debug modes.
     138            jit.move(MacroAssembler::TrustedImmPtr(object), scratchGPR);
     139            MacroAssembler::Jump ok = branchStructure(
     140                jit,
     141                MacroAssembler::Equal,
     142                MacroAssembler::Address(scratchGPR, JSCell::structureIDOffset()),
     143                structure);
     144            jit.abortWithReason(RepatchIneffectiveWatchpoint);
     145            ok.link(&jit);
     146        }
    146147        return;
    147148    }
    … …  
    15721573        CCallHelpers::Jump okArgumentCount = stubJit.branch32(
    15731574            CCallHelpers::Below, CCallHelpers::Address(CCallHelpers::stackPointerRegister, static_cast<ptrdiff_t>(sizeof(Register) * JSStack::ArgumentCount) + offsetToFrame + PayloadOffset), CCallHelpers::TrustedImm32(10000000));
    1574         stubJit.breakpoint();
     1575        stubJit.abortWithReason(RepatchInsaneArgumentCount);
    15751576        okArgumentCount.link(&stubJit);
    15761577    }

  • trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

    r168729 r168776  
    4646inline void emitPointerValidation(CCallHelpers& jit, GPRReg pointerGPR)
    4747{
    48 #if !ASSERT_DISABLED
     48    if (ASSERT_DISABLED)
     49        return;
    4950    CCallHelpers::Jump isNonZero = jit.branchTestPtr(CCallHelpers::NonZero, pointerGPR);
    50     jit.breakpoint();
     51    jit.abortWithReason(TGInvalidPointer);
    5152    isNonZero.link(&jit);
    5253    jit.pushToSave(pointerGPR);
    5354    jit.load8(pointerGPR, pointerGPR);
    5455    jit.popToRestore(pointerGPR);
    55 #else
    56     UNUSED_PARAM(jit);
    57     UNUSED_PARAM(pointerGPR);
    58 #endif
    5956}
    6057
    … …  
    374371#error "JIT not supported on this platform."
    375372    UNUSED_PARAM(executableOffsetToFunction);
    376     breakpoint();
     373    abortWithReason(TGNotSupported);
    377374#endif
    378375

  • trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

    r158208 r168776  
    16401640                ASSERT(term->quantityCount == 1);
    16411641
    1642 #ifndef NDEBUG
    16431642                // Runtime ASSERT to make sure that the nested alternative handled the
    16441643                // "no input consumed" check.
    1645                 if (term->quantityType != QuantifierFixedCount && !term->parentheses.disjunction->m_minimumSize) {
     1644                if (!ASSERT_DISABLED && term->quantityType != QuantifierFixedCount && !term->parentheses.disjunction->m_minimumSize) {
    16461645                    Jump pastBreakpoint;
    16471646                    pastBreakpoint = branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
    1648                     breakpoint();
     1647                    abortWithReason(YARRNoInputConsumed);
    16491648                    pastBreakpoint.link(this);
    16501649                }
    1651 #endif
    16521650
    16531651                // If the parenthese are capturing, store the ending index value to the
    … …  
    16961694            case OpParenthesesSubpatternTerminalEnd: {
    16971695                YarrOp& beginOp = m_ops[op.m_previousOp];
    1698 #ifndef NDEBUG
    1699                 PatternTerm* term = op.m_term;
    1700 
    1701                 // Runtime ASSERT to make sure that the nested alternative handled the
    1702                 // "no input consumed" check.
    1703                 Jump pastBreakpoint;
    1704                 pastBreakpoint = branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
    1705                 breakpoint();
    1706                 pastBreakpoint.link(this);
    1707 #endif
     1696                if (!ASSERT_DISABLED) {
     1697                    PatternTerm* term = op.m_term;
     1698                   
     1699                    // Runtime ASSERT to make sure that the nested alternative handled the
     1700                    // "no input consumed" check.
     1701                    Jump pastBreakpoint;
     1702                    pastBreakpoint = branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
     1703                    abortWithReason(YARRNoInputConsumed);
     1704                    pastBreakpoint.link(this);
     1705                }
    17081706
    17091707                // We know that the match is non-zero, we can accept it  and
Note: See TracChangeset for help on using the changeset viewer.