Changeset 200879 in webkit
- Timestamp:
- May 13, 2016, 1:16:29 PM (8 years ago)
- Location:
- trunk
- Files:
-
- 29 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r200876 r200879 1 2016-05-13 Mark Lam <mark.lam@apple.com> 2 3 We should have one calleeSaveRegistersBuffer per VMEntryFrame, not one per VM. 4 https://bugs.webkit.org/show_bug.cgi?id=157537 5 <rdar://problem/24794845> 6 7 Reviewed by Michael Saboff. 8 9 * inspector/debugger/regress-133182-expected.txt: 10 - Rebased test results to update line numbers. 11 * platform/mac/TestExpectations: 12 - Unskip the test. 13 1 14 2016-05-13 Doug Russell <d_russell@apple.com> 2 15 -
trunk/LayoutTests/inspector/debugger/regress-133182-expected.txt
r188142 r200879 1 CONSOLE MESSAGE: line 47: [1] Testing statement '({}).a.b.c.d;'2 CONSOLE MESSAGE: line 48: [1] Paused and about to step3 CONSOLE MESSAGE: line 6 0: [1] Resumed4 CONSOLE MESSAGE: line 52: [1] Paused after stepping5 CONSOLE MESSAGE: line 6 0: [1] Resumed1 CONSOLE MESSAGE: line 56: [1] Testing statement '({}).a.b.c.d;' 2 CONSOLE MESSAGE: line 57: [1] Paused and about to step 3 CONSOLE MESSAGE: line 69: [1] Resumed 4 CONSOLE MESSAGE: line 61: [1] Paused after stepping 5 CONSOLE MESSAGE: line 69: [1] Resumed 6 6 CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating '({}).a.b') 7 CONSOLE MESSAGE: line 47: [2] Testing statement 'exceptionBasic();'8 CONSOLE MESSAGE: line 48: [2] Paused and about to step9 CONSOLE MESSAGE: line 6 0: [2] Resumed10 CONSOLE MESSAGE: line 52: [2] Paused after stepping11 CONSOLE MESSAGE: line 6 0: [2] Resumed7 CONSOLE MESSAGE: line 56: [2] Testing statement 'exceptionBasic();' 8 CONSOLE MESSAGE: line 57: [2] Paused and about to step 9 CONSOLE MESSAGE: line 69: [2] Resumed 10 CONSOLE MESSAGE: line 61: [2] Paused after stepping 11 CONSOLE MESSAGE: line 69: [2] Resumed 12 12 CONSOLE MESSAGE: line 3: TypeError: undefined is not an object (evaluating '({}).a.b') 13 CONSOLE MESSAGE: line 47: [3] Testing statement 'exceptionDOM();'14 CONSOLE MESSAGE: line 48: [3] Paused and about to step15 CONSOLE MESSAGE: line 6 0: [3] Resumed16 CONSOLE MESSAGE: line 52: [3] Paused after stepping17 CONSOLE MESSAGE: line 6 0: [3] Resumed13 CONSOLE MESSAGE: line 56: [3] Testing statement 'exceptionDOM();' 14 CONSOLE MESSAGE: line 57: [3] Paused and about to step 15 CONSOLE MESSAGE: line 69: [3] Resumed 16 CONSOLE MESSAGE: line 61: [3] Paused after stepping 17 CONSOLE MESSAGE: line 69: [3] Resumed 18 18 CONSOLE MESSAGE: line 8: NotFoundError: DOM Exception 8: An attempt was made to reference a Node in a context where it does not exist. 19 CONSOLE MESSAGE: line 47: [4] Testing statement 'exceptionInHostFunction();'20 CONSOLE MESSAGE: line 48: [4] Paused and about to step21 CONSOLE MESSAGE: line 6 0: [4] Resumed22 CONSOLE MESSAGE: line 52: [4] Paused after stepping23 CONSOLE MESSAGE: line 6 0: [4] Resumed19 CONSOLE MESSAGE: line 56: [4] Testing statement 'exceptionInHostFunction();' 20 CONSOLE MESSAGE: line 57: [4] Paused and about to step 21 CONSOLE MESSAGE: line 69: [4] Resumed 22 CONSOLE MESSAGE: line 61: [4] Paused after stepping 23 CONSOLE MESSAGE: line 69: [4] Resumed 24 24 CONSOLE MESSAGE: line 24: exception in host function 25 CONSOLE MESSAGE: line 47: [5] Testing statement 'throwString();'26 CONSOLE MESSAGE: line 48: [5] Paused and about to step27 CONSOLE MESSAGE: line 6 0: [5] Resumed28 CONSOLE MESSAGE: line 52: [5] Paused after stepping29 CONSOLE MESSAGE: line 6 0: [5] Resumed25 CONSOLE MESSAGE: line 56: [5] Testing statement 'throwString();' 26 CONSOLE MESSAGE: line 57: [5] Paused and about to step 27 CONSOLE MESSAGE: line 69: [5] Resumed 28 CONSOLE MESSAGE: line 61: [5] Paused after stepping 29 CONSOLE MESSAGE: line 69: [5] Resumed 30 30 CONSOLE MESSAGE: line 13: exception string 31 CONSOLE MESSAGE: line 47: [6] Testing statement 'throwParam({x:1});'32 CONSOLE MESSAGE: line 48: [6] Paused and about to step33 CONSOLE MESSAGE: line 6 0: [6] Resumed34 CONSOLE MESSAGE: line 52: [6] Paused after stepping35 CONSOLE MESSAGE: line 6 0: [6] Resumed31 CONSOLE MESSAGE: line 56: [6] Testing statement 'throwParam({x:1});' 32 CONSOLE MESSAGE: line 57: [6] Paused and about to step 33 CONSOLE MESSAGE: line 69: [6] Resumed 34 CONSOLE MESSAGE: line 61: [6] Paused after stepping 35 CONSOLE MESSAGE: line 69: [6] Resumed 36 36 CONSOLE MESSAGE: line 18: [object Object] 37 CONSOLE MESSAGE: line 47: [7] Testing statement 'throwParam(new Error('error message'));'38 CONSOLE MESSAGE: line 48: [7] Paused and about to step39 CONSOLE MESSAGE: line 6 0: [7] Resumed40 CONSOLE MESSAGE: line 52: [7] Paused after stepping41 CONSOLE MESSAGE: line 6 0: [7] Resumed37 CONSOLE MESSAGE: line 56: [7] Testing statement 'throwParam(new Error('error message'));' 38 CONSOLE MESSAGE: line 57: [7] Paused and about to step 39 CONSOLE MESSAGE: line 69: [7] Resumed 40 CONSOLE MESSAGE: line 61: [7] Paused after stepping 41 CONSOLE MESSAGE: line 69: [7] Resumed 42 42 CONSOLE MESSAGE: line 18: Error: error message 43 43 Regression test for https://bugs.webkit.org/show_bug.cgi?id=133182 -
trunk/LayoutTests/platform/mac/TestExpectations
r200804 r200879 732 732 inspector/debugger/nested-inspectors.html 733 733 inspector/debugger/pause-reason.html 734 inspector/debugger/regress-133182.html735 734 736 735 webkit.org/b/124311 compositing/regions/transform-transparent-positioned-video-inside-region.html [ ImageOnlyFailure ] -
trunk/Source/JavaScriptCore/ChangeLog
r200866 r200879 1 2016-05-13 Mark Lam <mark.lam@apple.com> 2 3 We should have one calleeSaveRegistersBuffer per VMEntryFrame, not one per VM. 4 https://bugs.webkit.org/show_bug.cgi?id=157537 5 <rdar://problem/24794845> 6 7 Reviewed by Michael Saboff. 8 9 The pre-existing code behaves this way: 10 11 1. When JS code throws an exception, it saves callee save registers in 12 the VM calleeSaveRegistersBuffer. These values are meant to be restored 13 to the callee save registers later either at the catch handler or at the 14 uncaught exception handler. 15 16 2. If the Inspector is enable, the VM will invoke inspector C++ code to inspect 17 the exception. That C++ code can change the values of the callee save 18 registers. 19 20 The inspector code in turn re-enters the VM to execute JS inspector code. 21 22 The JS inspector code can run hot enough that we do an enterOptimizationCheck 23 on it. The enterOptimizationCheck first saves all callee save registers 24 into the VM calleeSaveRegistersBuffer. 25 26 This effectively overwrites the values in the VM calleeSaveRegistersBuffer 27 from (1). 28 29 3. Eventually, execution returns to the catch handler or the uncaught exception 30 handler which restores the overwritten values in the VM 31 calleeSaveRegistersBuffer to the callee save registers. 32 33 When execution returns to the C++ code that entered the VM before (1), the 34 values in the callee registers are not what that code expects, and badness 35 and/or crashes ensues. 36 37 This patch applies the following fix: 38 39 1. Allocate space in the VMEntryFrame for the calleeSaveRegistersBuffer. 40 This ensures that each VM entry session has its own buffer to use, and will 41 not corrupt the one from the previous VM entry session. 42 43 Delete the VM calleeSaveRegistersBuffer. 44 45 2. Change all locations that uses the VM calleeSaveRegistersBuffer to use the 46 calleeSaveRegistersBuffer in the current VMEntryFrame. 47 48 3. Renamed all uses of the term "VMCalleeSavesBuffer" to 49 "VMEntryFrameCalleeSavesBuffer". 50 51 This fix has been tested on the following configurations: 52 1. JSC and layout tests on a debug ASan build for 64-bit x86_64. 53 2. JSC tests on a release ASan build for 32-bit x86. 54 3. JSC tests on a release normal (non-ASan) build for ARM64. 55 4. JSC tests on a release normal (non-ASan) build for ARMv7 and ARMv7s. 56 5. JSC tests on a release ASan CLOOP build for x86_64. 57 58 These test runs did not produce any new crashes. The ASan CLOOP has some 59 pre-existing crashes which are not due to this patch. 60 61 This bug can be tested by running the inspector/debugger/regress-133182.html test 62 on an ASan build. 63 64 * bytecode/PolymorphicAccess.cpp: 65 (JSC::AccessGenerationState::emitExplicitExceptionHandler): 66 * dfg/DFGJITCompiler.cpp: 67 (JSC::DFG::JITCompiler::compileExceptionHandlers): 68 * dfg/DFGOSREntry.cpp: 69 (JSC::DFG::prepareOSREntry): 70 * dfg/DFGOSRExitCompiler.cpp: 71 * dfg/DFGOSRExitCompiler32_64.cpp: 72 (JSC::DFG::OSRExitCompiler::compileExit): 73 * dfg/DFGOSRExitCompiler64.cpp: 74 (JSC::DFG::OSRExitCompiler::compileExit): 75 * dfg/DFGThunks.cpp: 76 (JSC::DFG::osrEntryThunkGenerator): 77 * ftl/FTLCompile.cpp: 78 (JSC::FTL::compile): 79 * ftl/FTLLowerDFGToB3.cpp: 80 (JSC::FTL::DFG::LowerDFGToB3::lower): 81 * ftl/FTLOSRExitCompiler.cpp: 82 (JSC::FTL::compileStub): 83 * interpreter/Interpreter.cpp: 84 (JSC::UnwindFunctor::operator()): 85 (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer): 86 (JSC::UnwindFunctor::copyCalleeSavesToVMCalleeSavesBuffer): Deleted. 87 * interpreter/Interpreter.h: 88 (JSC::NativeCallFrameTracer::NativeCallFrameTracer): 89 * interpreter/VMEntryRecord.h: 90 (JSC::VMEntryRecord::calleeSaveRegistersBufferOffset): 91 (JSC::VMEntryRecord::prevTopCallFrame): 92 (JSC::VMEntryRecord::unsafePrevTopCallFrame): 93 (JSC::VMEntryFrame::vmEntryRecordOffset): 94 (JSC::VMEntryFrame::calleeSaveRegistersBufferOffset): 95 * jit/AssemblyHelpers.cpp: 96 (JSC::AssemblyHelpers::emitRandomThunk): 97 (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer): 98 (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer): Deleted. 99 * jit/AssemblyHelpers.h: 100 (JSC::AssemblyHelpers::emitRestoreSavedTagRegisters): 101 (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer): 102 (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer): 103 (JSC::AssemblyHelpers::copyCalleeSavesToVMCalleeSavesBuffer): Deleted. 104 (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer): Deleted. 105 * jit/JIT.cpp: 106 (JSC::JIT::emitEnterOptimizationCheck): 107 (JSC::JIT::privateCompileExceptionHandlers): 108 * jit/JITOpcodes.cpp: 109 (JSC::JIT::emit_op_throw): 110 (JSC::JIT::emit_op_catch): 111 (JSC::JIT::emitSlow_op_loop_hint): 112 * jit/JITOpcodes32_64.cpp: 113 (JSC::JIT::emit_op_throw): 114 (JSC::JIT::emit_op_catch): 115 * jit/ThunkGenerators.cpp: 116 (JSC::throwExceptionFromCallSlowPathGenerator): 117 (JSC::nativeForGenerator): 118 * llint/LLIntThunks.cpp: 119 (JSC::vmEntryRecord): 120 * llint/LowLevelInterpreter.asm: 121 * llint/LowLevelInterpreter32_64.asm: 122 * llint/LowLevelInterpreter64.asm: 123 * runtime/VM.h: 124 (JSC::VM::getCTIStub): 125 (JSC::VM::calleeSaveRegistersBufferOffset): Deleted. 126 * wasm/WASMFunctionCompiler.h: 127 (JSC::WASMFunctionCompiler::endFunction): 128 1 129 2016-05-13 Beth Dakin <bdakin@apple.com> 2 130 -
trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp
r200606 r200879 173 173 { 174 174 restoreScratch(); 175 jit->copyCalleeSavesToVM CalleeSavesBuffer();175 jit->copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 176 176 if (needsToRestoreRegistersIfException()) { 177 177 // To the JIT that produces the original exception handling -
trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
r200034 r200879 140 140 m_exceptionChecksWithCallFrameRollback.link(this); 141 141 142 copyCalleeSavesToVM CalleeSavesBuffer();142 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 143 143 144 144 // lookupExceptionHandlerFromCallerFrame is passed two arguments, the VM and the exec (the CallFrame*). … … 160 160 m_exceptionChecks.link(this); 161 161 162 copyCalleeSavesToVM CalleeSavesBuffer();162 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 163 163 164 164 // lookupExceptionHandler is passed two arguments, the VM and the exec (the CallFrame*). -
trunk/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
r200034 r200879 1 1 /* 2 * Copyright (C) 2011, 2013 , 2014, 2015Apple Inc. All rights reserved.2 * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 317 317 318 318 unsigned registerCount = registerSaveLocations->size(); 319 VMEntryRecord* record = vmEntryRecord(vm->topVMEntryFrame); 319 320 for (unsigned i = 0; i < registerCount; i++) { 320 321 RegisterAtOffset currentEntry = registerSaveLocations->at(i); 321 322 if (dontSaveRegisters.get(currentEntry.reg())) 322 323 continue; 323 RegisterAtOffset* vmCalleeSavesEntry = allCalleeSaves->find(currentEntry.reg());324 325 *(bitwise_cast<intptr_t*>(pivot - 1) - currentEntry.offsetAsIndex()) = vm->calleeSaveRegistersBuffer[vmCalleeSavesEntry->offsetAsIndex()];324 RegisterAtOffset* calleeSavesEntry = allCalleeSaves->find(currentEntry.reg()); 325 326 *(bitwise_cast<intptr_t*>(pivot - 1) - currentEntry.offsetAsIndex()) = record->calleeSaveRegistersBuffer[calleeSavesEntry->offsetAsIndex()]; 326 327 } 327 328 #endif -
trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
r198364 r200879 152 152 // We are acting as a defacto op_catch because we arrive here from genericUnwind(). 153 153 // So, we must restore our call frame and stack pointer. 154 jit.restoreCalleeSavesFromVM CalleeSavesBuffer();154 jit.restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(); 155 155 jit.loadPtr(vm->addressOfCallFrameForCatch(), GPRInfo::callFrameRegister); 156 156 jit.addPtr(CCallHelpers::TrustedImm32(codeBlock->stackPointerOffset() * sizeof(Register)), -
trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
r200606 r200879 256 256 257 257 if (exit.isExceptionHandler()) 258 m_jit.copyCalleeSavesToVM CalleeSavesBuffer();258 m_jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 259 259 260 260 // Do all data format conversions and store the results into the stack. -
trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
r200606 r200879 266 266 267 267 if (exit.isExceptionHandler()) 268 m_jit.copyCalleeSavesToVM CalleeSavesBuffer();268 m_jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 269 269 270 270 // Do all data format conversions and store the results into the stack. -
trunk/Source/JavaScriptCore/dfg/DFGThunks.cpp
r194772 r200879 136 136 137 137 ok.link(&jit); 138 jit.restoreCalleeSavesFromVM CalleeSavesBuffer();138 jit.restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(); 139 139 jit.emitMaterializeTagCheckRegisters(); 140 140 -
trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp
r198600 r200879 122 122 // Emit the exception handler. 123 123 *state.exceptionHandler = jit.label(); 124 jit.copyCalleeSavesToVM CalleeSavesBuffer();124 jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 125 125 jit.move(MacroAssembler::TrustedImmPtr(jit.vm()), GPRInfo::argumentGPR0); 126 126 jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1); -
trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
r200701 r200879 207 207 AllowMacroScratchRegisterUsage allowScratch(jit); 208 208 209 jit.copyCalleeSavesToVM CalleeSavesBuffer();209 jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 210 210 jit.move(CCallHelpers::TrustedImmPtr(jit.vm()), GPRInfo::argumentGPR0); 211 211 jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1); -
trunk/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
r200606 r200879 187 187 if (exit.isGenericUnwindHandler()) { 188 188 RELEASE_ASSERT(vm->callFrameForCatch); // The first time we hit this exit, like at all other times, this field should be non-null. 189 jit.restoreCalleeSavesFromVM CalleeSavesBuffer();189 jit.restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(); 190 190 jit.loadPtr(vm->addressOfCallFrameForCatch(), MacroAssembler::framePointerRegister); 191 191 jit.addPtr(CCallHelpers::TrustedImm32(codeBlock->stackPointerOffset() * sizeof(Register)), … … 442 442 RegisterAtOffsetList* vmCalleeSaves = vm->getAllCalleeSaveRegisterOffsets(); 443 443 RegisterSet vmCalleeSavesToSkip = RegisterSet::stackRegisters(); 444 if (exit.isExceptionHandler()) 445 jit.move(CCallHelpers::TrustedImmPtr(vm->calleeSaveRegistersBuffer), GPRInfo::regT1); 444 if (exit.isExceptionHandler()) { 445 jit.loadPtr(&vm->topVMEntryFrame, GPRInfo::regT1); 446 jit.addPtr(CCallHelpers::TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), GPRInfo::regT1); 447 } 446 448 447 449 for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) { -
trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp
r200856 r200879 696 696 profiler->exceptionUnwind(m_callFrame); 697 697 698 copyCalleeSavesToVM CalleeSavesBuffer(visitor);698 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(visitor); 699 699 700 700 return StackVisitor::Done; 701 701 } 702 702 703 copyCalleeSavesToVM CalleeSavesBuffer(visitor);703 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(visitor); 704 704 705 705 return StackVisitor::Continue; … … 707 707 708 708 private: 709 void copyCalleeSavesToVM CalleeSavesBuffer(StackVisitor& visitor) const709 void copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(StackVisitor& visitor) const 710 710 { 711 711 #if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0 … … 729 729 730 730 unsigned registerCount = currentCalleeSaves->size(); 731 VMEntryRecord* record = vmEntryRecord(vm.topVMEntryFrame); 731 732 for (unsigned i = 0; i < registerCount; i++) { 732 733 RegisterAtOffset currentEntry = currentCalleeSaves->at(i); 733 734 if (dontCopyRegisters.get(currentEntry.reg())) 734 735 continue; 735 RegisterAtOffset* vmCalleeSavesEntry = allCalleeSaves->find(currentEntry.reg());736 RegisterAtOffset* calleeSavesEntry = allCalleeSaves->find(currentEntry.reg()); 736 737 737 vm.calleeSaveRegistersBuffer[vmCalleeSavesEntry->offsetAsIndex()] = *(frame + currentEntry.offsetAsIndex());738 record->calleeSaveRegistersBuffer[calleeSavesEntry->offsetAsIndex()] = *(frame + currentEntry.offsetAsIndex()); 738 739 } 739 740 #else -
trunk/Source/JavaScriptCore/interpreter/Interpreter.h
r199852 r200879 146 146 ASSERT(vm); 147 147 ASSERT(callFrame); 148 ASSERT( callFrame < vm->topVMEntryFrame);148 ASSERT(reinterpret_cast<void*>(callFrame) < reinterpret_cast<void*>(vm->topVMEntryFrame)); 149 149 vm->topCallFrame = callFrame; 150 150 } -
trunk/Source/JavaScriptCore/interpreter/VMEntryRecord.h
r196658 r200879 1 1 /* 2 * Copyright (C) 2014 Apple Inc. All rights reserved.2 * Copyright (C) 2014, 2016 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 27 27 #define VMEntryRecord_h 28 28 29 #include "GPRInfo.h" 30 29 31 namespace JSC { 30 32 31 typedef void VMEntryFrame; 32 33 struct VMEntryFrame; 33 34 class ExecState; 34 35 class VM; … … 43 44 VMEntryFrame* m_prevTopVMEntryFrame; 44 45 46 #if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0 47 intptr_t calleeSaveRegistersBuffer[NUMBER_OF_CALLEE_SAVES_REGISTERS]; 48 #endif 49 45 50 ExecState* prevTopCallFrame() { return m_prevTopCallFrame; } 46 51 SUPPRESS_ASAN ExecState* unsafePrevTopCallFrame() { return m_prevTopCallFrame; } … … 52 57 extern "C" VMEntryRecord* vmEntryRecord(VMEntryFrame*); 53 58 59 struct VMEntryFrame { 60 #if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0 61 static ptrdiff_t vmEntryRecordOffset() 62 { 63 VMEntryFrame* fakeVMEntryFrame = reinterpret_cast<VMEntryFrame*>(0x1000); 64 VMEntryRecord* record = vmEntryRecord(fakeVMEntryFrame); 65 return static_cast<ptrdiff_t>( 66 reinterpret_cast<char*>(record) - reinterpret_cast<char*>(fakeVMEntryFrame)); 67 } 68 69 static ptrdiff_t calleeSaveRegistersBufferOffset() 70 { 71 return vmEntryRecordOffset() + OBJECT_OFFSETOF(VMEntryRecord, calleeSaveRegistersBuffer); 72 } 73 #endif 74 }; 75 54 76 } // namespace JSC 55 77 -
trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
r199166 r200879 567 567 #endif 568 568 569 void AssemblyHelpers::restoreCalleeSavesFromVM CalleeSavesBuffer()569 void AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer() 570 570 { 571 571 #if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0 572 char* sourceBuffer = bitwise_cast<char*>(m_vm->calleeSaveRegistersBuffer);573 574 572 RegisterAtOffsetList* allCalleeSaves = m_vm->getAllCalleeSaveRegisterOffsets(); 575 573 RegisterSet dontRestoreRegisters = RegisterSet::stackRegisters(); 576 574 unsigned registerCount = allCalleeSaves->size(); 577 575 576 GPRReg scratch = InvalidGPRReg; 577 unsigned scratchGPREntryIndex = 0; 578 579 // Use the first GPR entry's register as our scratch. 578 580 for (unsigned i = 0; i < registerCount; i++) { 579 581 RegisterAtOffset entry = allCalleeSaves->at(i); 580 582 if (dontRestoreRegisters.get(entry.reg())) 581 583 continue; 582 if (entry.reg().isGPR()) 583 loadPtr(static_cast<void*>(sourceBuffer + entry.offset()), entry.reg().gpr()); 584 else 585 loadDouble(TrustedImmPtr(sourceBuffer + entry.offset()), entry.reg().fpr()); 586 } 584 if (entry.reg().isGPR()) { 585 scratchGPREntryIndex = i; 586 scratch = entry.reg().gpr(); 587 break; 588 } 589 } 590 ASSERT(scratch != InvalidGPRReg); 591 592 loadPtr(&m_vm->topVMEntryFrame, scratch); 593 addPtr(TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), scratch); 594 595 // Restore all callee saves except for the scratch. 596 for (unsigned i = 0; i < registerCount; i++) { 597 RegisterAtOffset entry = allCalleeSaves->at(i); 598 if (dontRestoreRegisters.get(entry.reg())) 599 continue; 600 if (entry.reg().isGPR()) { 601 if (i != scratchGPREntryIndex) 602 loadPtr(Address(scratch, entry.offset()), entry.reg().gpr()); 603 } else 604 loadDouble(Address(scratch, entry.offset()), entry.reg().fpr()); 605 } 606 607 // Restore the callee save value of the scratch. 608 RegisterAtOffset entry = allCalleeSaves->at(scratchGPREntryIndex); 609 ASSERT(!dontRestoreRegisters.get(entry.reg())); 610 ASSERT(entry.reg().isGPR()); 611 ASSERT(scratch == entry.reg().gpr()); 612 loadPtr(Address(scratch, entry.offset()), scratch); 587 613 #endif 588 614 } -
trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h
r200606 r200879 314 314 } 315 315 316 void copyCalleeSavesToVM CalleeSavesBuffer(const TempRegisterSet& usedRegisters = { RegisterSet::stubUnavailableRegisters() })316 void copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(const TempRegisterSet& usedRegisters = { RegisterSet::stubUnavailableRegisters() }) 317 317 { 318 318 #if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0 319 319 GPRReg temp1 = usedRegisters.getFreeGPR(0); 320 320 321 move(TrustedImmPtr(m_vm->calleeSaveRegistersBuffer), temp1); 321 loadPtr(&m_vm->topVMEntryFrame, temp1); 322 addPtr(TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), temp1); 322 323 323 324 RegisterAtOffsetList* allCalleeSaves = m_vm->getAllCalleeSaveRegisterOffsets(); … … 339 340 } 340 341 341 void restoreCalleeSavesFromVM CalleeSavesBuffer();342 343 void copyCalleeSavesFromFrameOrRegisterToVM CalleeSavesBuffer(const TempRegisterSet& usedRegisters = { RegisterSet::stubUnavailableRegisters() })342 void restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(); 343 344 void copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer(const TempRegisterSet& usedRegisters = { RegisterSet::stubUnavailableRegisters() }) 344 345 { 345 346 #if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0 … … 352 353 353 354 // Copy saved calleeSaves on stack or unsaved calleeSaves in register to vm calleeSave buffer 354 move(TrustedImmPtr(m_vm->calleeSaveRegistersBuffer), temp1); 355 loadPtr(&m_vm->topVMEntryFrame, temp1); 356 addPtr(TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), temp1); 355 357 356 358 RegisterAtOffsetList* allCalleeSaves = m_vm->getAllCalleeSaveRegisterOffsets(); -
trunk/Source/JavaScriptCore/jit/JIT.cpp
r200658 r200879 97 97 ASSERT(!m_bytecodeOffset); 98 98 99 copyCalleeSavesFromFrameOrRegisterToVM CalleeSavesBuffer();99 copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer(); 100 100 101 101 callOperation(operationOptimize, m_bytecodeOffset); … … 786 786 m_exceptionChecksWithCallFrameRollback.link(this); 787 787 788 copyCalleeSavesToVM CalleeSavesBuffer();788 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 789 789 790 790 // lookupExceptionHandlerFromCallerFrame is passed two arguments, the VM and the exec (the CallFrame*). … … 805 805 m_exceptionChecks.link(this); 806 806 807 copyCalleeSavesToVM CalleeSavesBuffer();807 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 808 808 809 809 // lookupExceptionHandler is passed two arguments, the VM and the exec (the CallFrame*). -
trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp
r200102 r200879 443 443 { 444 444 ASSERT(regT0 == returnValueGPR); 445 copyCalleeSavesToVM CalleeSavesBuffer();445 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 446 446 emitGetVirtualRegister(currentInstruction[1].u.operand, regT0); 447 447 callOperationNoExceptionCheck(operationThrow, regT0); … … 519 519 void JIT::emit_op_catch(Instruction* currentInstruction) 520 520 { 521 restoreCalleeSavesFromVM CalleeSavesBuffer();521 restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(); 522 522 523 523 move(TrustedImmPtr(m_vm), regT3); … … 936 936 linkSlowCase(iter); 937 937 938 copyCalleeSavesFromFrameOrRegisterToVM CalleeSavesBuffer();938 copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer(); 939 939 940 940 callOperation(operationOptimize, m_bytecodeOffset); -
trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
r200102 r200879 788 788 { 789 789 ASSERT(regT0 == returnValueGPR); 790 copyCalleeSavesToVM CalleeSavesBuffer();790 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 791 791 emitLoad(currentInstruction[1].u.operand, regT1, regT0); 792 792 callOperationNoExceptionCheck(operationThrow, regT1, regT0); … … 848 848 void JIT::emit_op_catch(Instruction* currentInstruction) 849 849 { 850 restoreCalleeSavesFromVM CalleeSavesBuffer();850 restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(); 851 851 852 852 move(TrustedImmPtr(m_vm), regT3); -
trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp
r200422 r200879 67 67 jit.preserveReturnAddressAfterCall(GPRInfo::nonPreservedNonReturnGPR); 68 68 69 jit.copyCalleeSavesToVM CalleeSavesBuffer();69 jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 70 70 71 71 jit.setupArguments(CCallHelpers::TrustedImmPtr(vm), GPRInfo::callFrameRegister); … … 356 356 exceptionHandler.link(&jit); 357 357 358 jit.copyCalleeSavesToVM CalleeSavesBuffer();358 jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 359 359 jit.storePtr(JSInterfaceJIT::callFrameRegister, &vm->topCallFrame); 360 360 -
trunk/Source/JavaScriptCore/llint/LLIntThunks.cpp
r189201 r200879 117 117 intptr_t stackAlignment = stackAlignmentBytes(); 118 118 intptr_t VMEntryTotalFrameSize = (sizeof(VMEntryRecord) + (stackAlignment - 1)) & ~(stackAlignment - 1); 119 return reinterpret_cast<VMEntryRecord*>( static_cast<char*>(entryFrame) - VMEntryTotalFrameSize);119 return reinterpret_cast<VMEntryRecord*>(reinterpret_cast<char*>(entryFrame) - VMEntryTotalFrameSize); 120 120 } 121 121 -
trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
r200586 r200879 569 569 end 570 570 571 macro copyCalleeSavesToVM CalleeSavesBuffer(vm, temp)571 macro copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(vm, temp) 572 572 if ARM64 or X86_64 or X86_64_WIN 573 leap VM::calleeSaveRegistersBuffer[vm], temp 573 loadp VM::topVMEntryFrame[vm], temp 574 vmEntryRecord(temp, temp) 575 leap VMEntryRecord::calleeSaveRegistersBuffer[temp], temp 574 576 if ARM64 575 577 storep csr0, [temp] … … 609 611 end 610 612 611 macro restoreCalleeSavesFromVM CalleeSavesBuffer(vm, temp)613 macro restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(vm, temp) 612 614 if ARM64 or X86_64 or X86_64_WIN 613 leap VM::calleeSaveRegistersBuffer[vm], temp 615 loadp VM::topVMEntryFrame[vm], temp 616 vmEntryRecord(temp, temp) 617 leap VMEntryRecord::calleeSaveRegistersBuffer[temp], temp 614 618 if ARM64 615 619 loadp [temp], csr0 -
trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
r200102 r200879 303 303 andp MarkedBlockMask, t3 304 304 loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3 305 restoreCalleeSavesFromVM CalleeSavesBuffer(t3, t0)305 restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0) 306 306 loadp VM::callFrameForCatch[t3], cfr 307 307 storep 0, VM::callFrameForCatch[t3] … … 1916 1916 andp MarkedBlockMask, t3 1917 1917 loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3 1918 restoreCalleeSavesFromVM CalleeSavesBuffer(t3, t0)1918 restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0) 1919 1919 loadp VM::callFrameForCatch[t3], cfr 1920 1920 storep 0, VM::callFrameForCatch[t3] … … 1966 1966 andp MarkedBlockMask, t1 1967 1967 loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t1], t1 1968 copyCalleeSavesToVM CalleeSavesBuffer(t1, t2)1968 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(t1, t2) 1969 1969 jmp VM::targetMachinePCForThrow[t1] 1970 1970 -
trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
r200102 r200879 275 275 andp MarkedBlockMask, t3 276 276 loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3 277 restoreCalleeSavesFromVM CalleeSavesBuffer(t3, t0)277 restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0) 278 278 loadp VM::callFrameForCatch[t3], cfr 279 279 storep 0, VM::callFrameForCatch[t3] … … 1795 1795 andp MarkedBlockMask, t3 1796 1796 loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3 1797 restoreCalleeSavesFromVM CalleeSavesBuffer(t3, t0)1797 restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0) 1798 1798 loadp VM::callFrameForCatch[t3], cfr 1799 1799 storep 0, VM::callFrameForCatch[t3] … … 1841 1841 andp MarkedBlockMask, t1 1842 1842 loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t1], t1 1843 copyCalleeSavesToVM CalleeSavesBuffer(t1, t2)1843 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(t1, t2) 1844 1844 1845 1845 callSlowPath(_llint_slow_path_handle_exception) -
trunk/Source/JavaScriptCore/runtime/VM.h
r200658 r200879 35 35 #include "ExecutableAllocator.h" 36 36 #include "FunctionHasExecutedCache.h" 37 #if ENABLE(JIT)38 #include "GPRInfo.h"39 #endif40 37 #include "Heap.h" 41 38 #include "Intrinsic.h" … … 385 382 Interpreter* interpreter; 386 383 #if ENABLE(JIT) 387 #if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0388 intptr_t calleeSaveRegistersBuffer[NUMBER_OF_CALLEE_SAVES_REGISTERS];389 390 static ptrdiff_t calleeSaveRegistersBufferOffset()391 {392 return OBJECT_OFFSETOF(VM, calleeSaveRegistersBuffer);393 }394 #endif // NUMBER_OF_CALLEE_SAVES_REGISTERS > 0395 396 384 std::unique_ptr<JITThunks> jitStubs; 397 385 MacroAssemblerCodeRef getCTIStub(ThunkGenerator generator) -
trunk/Source/JavaScriptCore/wasm/WASMFunctionCompiler.h
r200399 r200879 238 238 m_exceptionChecks.link(this); 239 239 240 copyCalleeSavesToVM CalleeSavesBuffer();240 copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 241 241 242 242 // lookupExceptionHandler is passed two arguments, the VM and the exec (the CallFrame*).
Note:
See TracChangeset
for help on using the changeset viewer.