Changeset 202797 in webkit


Ignore:
Timestamp:
Jul 3, 2016 10:39:17 PM (8 years ago)
Author:
Yusuke Suzuki
Message:

[JSC] MacroAssemblerX86::branch8 should accept unsigned 8bit value
​https://bugs.webkit.org/show_bug.cgi?id=159334

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

As described in branchTest8 functions, byte in TrustedImm32 is not well defined.
So the assertion here should be a little permissive; accepting -128 to 255.

This assertion is originally fired when executing misc-bugs-847389-jpeg2000 benchmark in Debug build.
So this patch includes misc-bugs-847389-jpeg2000 benchmark.

  • assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::branchTest8):
(JSC::MacroAssemblerX86Common::branch8):

  • b3/testb3.cpp:

(JSC::B3::testBranch8WithLoad8ZIndex):
(JSC::B3::run):

LayoutTests:

  • TestExpectations:
  • js/regress/misc-bugs-847389-jpeg2000-expected.txt: Added.
  • js/regress/misc-bugs-847389-jpeg2000.html: Added.
  • js/regress/script-tests/misc-bugs-847389-jpeg2000.js: Added.

(error):
(warn):
(JpxImage.JpxImageClosure.JpxImage):
(JpxImage.JpxImageClosure.JpxImage.prototype.load.JpxImage_load.xhr.onload):
(JpxImage.JpxImageClosure.JpxImage.prototype.load):
(JpxImage.JpxImageClosure.JpxImage.prototype.parse.JpxImage_parse.readUint):
(JpxImage.JpxImageClosure.JpxImage.prototype.parse):
(JpxImage.JpxImageClosure.JpxImage.prototype.parseCodestream):
(JpxImage.JpxImageClosure.readUint32):
(JpxImage.JpxImageClosure.readUint16):
(JpxImage.JpxImageClosure.log2):
(JpxImage.JpxImageClosure.calculateComponentDimensions):
(JpxImage.JpxImageClosure.calculateTileGrids):
(JpxImage.JpxImageClosure.getBlocksDimensions):
(JpxImage.JpxImageClosure.buildPrecincts):
(JpxImage.JpxImageClosure.buildCodeblocks):
(JpxImage.JpxImageClosure.createPacket):
(JpxImage.JpxImageClosure.LayerResolutionComponentPositionIterator.this.nextPacket):
(JpxImage.JpxImageClosure.LayerResolutionComponentPositionIterator):
(JpxImage.JpxImageClosure.ResolutionLayerComponentPositionIterator.this.nextPacket):
(JpxImage.JpxImageClosure.ResolutionLayerComponentPositionIterator):
(JpxImage.JpxImageClosure.buildPackets):
(JpxImage.JpxImageClosure.readBits):
(JpxImage.JpxImageClosure.alignToByte):
(JpxImage.JpxImageClosure.readCodingpasses):
(JpxImage.JpxImageClosure.parseTilePackets):
(JpxImage.JpxImageClosure.copyCoefficients):
(JpxImage.JpxImageClosure.transformTile):
(JpxImage.JpxImageClosure.transformComponents):
(JpxImage.JpxImageClosure.initializeTile):
(JpxImage.JpxImageClosure.):
(JpxImage.JpxImageClosure.TagTree):
(JpxImage.JpxImageClosure.InclusionTree):
(JpxImage.JpxImageClosure.ArithmeticDecoder):
(JpxImage.JpxImageClosure.BitModel):
(JpxImage.JpxImageClosure.Transform):
(JpxImage.JpxImageClosure.IrreversibleTransform):
(JpxImage.JpxImageClosure.ReversibleTransform):
(JpxImage):
(atob):

Location:
trunk
Files:
3 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r202796 r202797  
     12016-07-01  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [JSC] MacroAssemblerX86::branch8 should accept unsigned 8bit value
     4        https://bugs.webkit.org/show_bug.cgi?id=159334
     5
     6        Reviewed by Benjamin Poulain.
     7
     8        * TestExpectations:
     9        * js/regress/misc-bugs-847389-jpeg2000-expected.txt: Added.
     10        * js/regress/misc-bugs-847389-jpeg2000.html: Added.
     11        * js/regress/script-tests/misc-bugs-847389-jpeg2000.js: Added.
     12        (error):
     13        (warn):
     14        (JpxImage.JpxImageClosure.JpxImage):
     15        (JpxImage.JpxImageClosure.JpxImage.prototype.load.JpxImage_load.xhr.onload):
     16        (JpxImage.JpxImageClosure.JpxImage.prototype.load):
     17        (JpxImage.JpxImageClosure.JpxImage.prototype.parse.JpxImage_parse.readUint):
     18        (JpxImage.JpxImageClosure.JpxImage.prototype.parse):
     19        (JpxImage.JpxImageClosure.JpxImage.prototype.parseCodestream):
     20        (JpxImage.JpxImageClosure.readUint32):
     21        (JpxImage.JpxImageClosure.readUint16):
     22        (JpxImage.JpxImageClosure.log2):
     23        (JpxImage.JpxImageClosure.calculateComponentDimensions):
     24        (JpxImage.JpxImageClosure.calculateTileGrids):
     25        (JpxImage.JpxImageClosure.getBlocksDimensions):
     26        (JpxImage.JpxImageClosure.buildPrecincts):
     27        (JpxImage.JpxImageClosure.buildCodeblocks):
     28        (JpxImage.JpxImageClosure.createPacket):
     29        (JpxImage.JpxImageClosure.LayerResolutionComponentPositionIterator.this.nextPacket):
     30        (JpxImage.JpxImageClosure.LayerResolutionComponentPositionIterator):
     31        (JpxImage.JpxImageClosure.ResolutionLayerComponentPositionIterator.this.nextPacket):
     32        (JpxImage.JpxImageClosure.ResolutionLayerComponentPositionIterator):
     33        (JpxImage.JpxImageClosure.buildPackets):
     34        (JpxImage.JpxImageClosure.readBits):
     35        (JpxImage.JpxImageClosure.alignToByte):
     36        (JpxImage.JpxImageClosure.readCodingpasses):
     37        (JpxImage.JpxImageClosure.parseTilePackets):
     38        (JpxImage.JpxImageClosure.copyCoefficients):
     39        (JpxImage.JpxImageClosure.transformTile):
     40        (JpxImage.JpxImageClosure.transformComponents):
     41        (JpxImage.JpxImageClosure.initializeTile):
     42        (JpxImage.JpxImageClosure.):
     43        (JpxImage.JpxImageClosure.TagTree):
     44        (JpxImage.JpxImageClosure.InclusionTree):
     45        (JpxImage.JpxImageClosure.ArithmeticDecoder):
     46        (JpxImage.JpxImageClosure.BitModel):
     47        (JpxImage.JpxImageClosure.Transform):
     48        (JpxImage.JpxImageClosure.IrreversibleTransform):
     49        (JpxImage.JpxImageClosure.ReversibleTransform):
     50        (JpxImage):
     51        (atob):
     52
    1532016-07-03  Benjamin Poulain  <bpoulain@apple.com>
    254

  • trunk/LayoutTests/TestExpectations

    r202769 r202797  
    989989
    990990webkit.org/b/159370 [ Debug ] fast/history/page-cache-destroy-document.html [ Skip ]
     991
     992[ Debug ] js/regress/misc-bugs-847389-jpeg2000.html [ Skip ]

  • trunk/Source/JavaScriptCore/ChangeLog

    r202796 r202797  
     12016-07-01  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [JSC] MacroAssemblerX86::branch8 should accept unsigned 8bit value
     4        https://bugs.webkit.org/show_bug.cgi?id=159334
     5
     6        Reviewed by Benjamin Poulain.
     7
     8        As described in branchTest8 functions, byte in TrustedImm32 is not well defined.
     9        So the assertion here should be a little permissive; accepting -128 to 255.
     10
     11        This assertion is originally fired when executing misc-bugs-847389-jpeg2000 benchmark in Debug build.
     12        So this patch includes misc-bugs-847389-jpeg2000 benchmark.
     13
     14        * assembler/MacroAssemblerX86Common.h:
     15        (JSC::MacroAssemblerX86Common::branchTest8):
     16        (JSC::MacroAssemblerX86Common::branch8):
     17        * b3/testb3.cpp:
     18        (JSC::B3::testBranch8WithLoad8ZIndex):
     19        (JSC::B3::run):
     20
    1212016-07-03  Benjamin Poulain  <bpoulain@apple.com>
    222

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h

    r201208 r202797  
    22192219    Jump branchTest8(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
    22202220    {
    2221         // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
     2221        // Byte in TrustedImm32 is not well defined, so be a little permissive here, but don't accept nonsense values.
    22222222        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
    22232223        if (mask.m_value == -1)
    … …  
    22302230    Jump branchTest8(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
    22312231    {
    2232         // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
     2232        // Byte in TrustedImm32 is not well defined, so be a little permissive here, but don't accept nonsense values.
    22332233        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
    22342234        if (mask.m_value == -1)
    … …  
    22412241    Jump branch8(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
    22422242    {
    2243         ASSERT(std::numeric_limits<int8_t>::min() <= right.m_value && right.m_value <= std::numeric_limits<int8_t>::max());
     2243        // Byte in TrustedImm32 is not well defined, so be a little permissive here, but don't accept nonsense values.
     2244        ASSERT(right.m_value >= -128 && right.m_value <= 255);
    22442245
    22452246        m_assembler.cmpb_im(right.m_value, left.offset, left.base, left.index, left.scale);

  • trunk/Source/JavaScriptCore/b3/testb3.cpp

    r202512 r202797  
    72867286    cond = 0;
    72877287    CHECK(invoke<int>(*code, &cond) == 0);
     7288}
     7289
     7290void testBranch8WithLoad8ZIndex()
     7291{
     7292    Procedure proc;
     7293    BasicBlock* root = proc.addBlock();
     7294    BasicBlock* thenCase = proc.addBlock();
     7295    BasicBlock* elseCase = proc.addBlock();
     7296
     7297    int logScale = 1;
     7298    root->appendNew<ControlValue>(
     7299        proc, Branch, Origin(),
     7300        root->appendNew<Value>(
     7301            proc, Above, Origin(),
     7302            root->appendNew<MemoryValue>(
     7303                proc, Load8Z, Origin(),
     7304                root->appendNew<Value>(
     7305                    proc, Add, Origin(),
     7306                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
     7307                    root->appendNew<Value>(
     7308                        proc, Shl, Origin(),
     7309                        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
     7310                        root->appendNew<Const32Value>(proc, Origin(), logScale)))),
     7311            root->appendNew<Const32Value>(proc, Origin(), 250)),
     7312        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
     7313
     7314    thenCase->appendNew<ControlValue>(
     7315        proc, Return, Origin(),
     7316        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
     7317
     7318    elseCase->appendNew<ControlValue>(
     7319        proc, Return, Origin(),
     7320        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
     7321
     7322    auto code = compile(proc);
     7323    uint32_t cond;
     7324    cond = 0xffffffffU; // All bytes are 0xff.
     7325    CHECK(invoke<int>(*code, &cond - 2, (sizeof(uint32_t) * 2) >> logScale) == 1);
     7326    cond = 0x00000000U; // All bytes are 0.
     7327    CHECK(invoke<int>(*code, &cond - 2, (sizeof(uint32_t) * 2) >> logScale) == 0);
    72887328}
    72897329
    … …  
    1290112941    RUN(testBranchLoad16S());
    1290212942    RUN(testBranchLoad16Z());
     12943    RUN(testBranch8WithLoad8ZIndex());
    1290312944
    1290412945    RUN(testComplex(64, 128));
Note: See TracChangeset for help on using the changeset viewer.