Changeset 210259 in webkit

Timestamp:

Jan 3, 2017 5:14:59 PM (7 years ago)

Author:

jfbastien@apple.com

Message:

REGRESSION (r210244): Release JSC Stress test failure: wasm.yaml/wasm/js-api/wasm-to-wasm.js.default-wasm
​https://bugs.webkit.org/show_bug.cgi?id=166669
<rdar://problem/29856455>

Reviewed by Saam Barati.

Bug #165282 added wasm -> wasm calls, but caused crashes in
release builds because the pinned registers are also callee-saved
and were being clobbered. B3 didn't see itself clobbering them
when no memory was used, and therefore omitted a restore.

This was causing the C++ code in callWebAssemblyFunction to crash
because $r12 was 0, and it expected it to have its value prior to
the call.

• wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::createJSToWasmWrapper):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• wasm/WasmB3IRGenerator.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-01-03  JF Bastien  <jfbastien@apple.com>
+
+        REGRESSION (r210244): Release JSC Stress test failure: wasm.yaml/wasm/js-api/wasm-to-wasm.js.default-wasm
+        https://bugs.webkit.org/show_bug.cgi?id=166669
+        <rdar://problem/29856455>
+
+        Reviewed by Saam Barati.
+
+        Bug #165282 added wasm -> wasm calls, but caused crashes in
+        release builds because the pinned registers are also callee-saved
+        and were being clobbered. B3 didn't see itself clobbering them
+        when no memory was used, and therefore omitted a restore.
+
+        This was causing the C++ code in callWebAssemblyFunction to crash
+        because $r12 was 0, and it expected it to have its value prior to
+        the call.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::createJSToWasmWrapper):
+
 2017-01-03  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp

@@ -1065 +1065 @@
     Value* result = wasmCallingConvention().setupCall(proc, block, origin, arguments, toB3Type(signature->returnType()), [&] (PatchpointValue* patchpoint) {
         CompilationContext* context = &compilationContext;
+
+        // wasm -> wasm calls clobber pinned registers unconditionally. This JS -> wasm transition must therefore restore these pinned registers (which are usually callee-saved) to account for this.
+        const PinnedRegisterInfo* pinnedRegs = &PinnedRegisterInfo::get();
+        RegisterSet clobbers;
+        clobbers.set(pinnedRegs->baseMemoryPointer);
+        for (auto info : pinnedRegs->sizeRegisters)
+            clobbers.set(info.sizeRegister);
+        patchpoint->effects.writesPinned = true;
+        patchpoint->clobber(clobbers);
+
         patchpoint->setGenerator([context] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
             AllowMacroScratchRegisterUsage allowScratch(jit);