Changeset 242067 in webkit

Timestamp:

Feb 25, 2019 6:59:47 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] stress/function-constructor-reading-from-global-lexical-environment.js fails in 32bit arch
​https://bugs.webkit.org/show_bug.cgi?id=195030
<rdar://problem/48385088>

Reviewed by Saam Barati.

While LLInt64 has checkTDZInGlobalPutToScopeIfNecessary for op_put_to_scope GlobalLexicalVar to check the value in the variable slot is not empty,
this check is missing in LLInt32_64. Previously, this check was subsumed accidentally by the WatchpointSet check in GlobalLexicalVar in notifyWrite:
because no "put" attempt succeeds here, the status WatchpointSet was ClearWatchpoint, we always go to the slow path, and we always throw the TDZ error
before configuring the WatchpointSet in the slow path. But after r241862, WatchpointSet is not used under non-JIT configuration. This skips WatchpointSet
check and LLInt32_64 starts failing tests because of lack of checkTDZInGlobalPutToScopeIfNecessary. This patch adds checkTDZInGlobalPutToScopeIfNecessary
in LLInt32_64 too. This patch fixes the following four failing tests.

stress/function-constructor-reading-from-global-lexical-environment.js.bytecode-cache
stress/function-constructor-reading-from-global-lexical-environment.js.default
stress/global-lexical-variable-tdz.js.bytecode-cache
stress/global-lexical-variable-tdz.js.default

• llint/LowLevelInterpreter32_64.asm:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• llint/LowLevelInterpreter32_64.asm (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-02-25  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] stress/function-constructor-reading-from-global-lexical-environment.js fails in 32bit arch
+        https://bugs.webkit.org/show_bug.cgi?id=195030
+        <rdar://problem/48385088>
+
+        Reviewed by Saam Barati.
+
+        While LLInt64 has checkTDZInGlobalPutToScopeIfNecessary for op_put_to_scope GlobalLexicalVar to check the value in the variable slot is not empty,
+        this check is missing in LLInt32_64. Previously, this check was subsumed accidentally by the WatchpointSet check in GlobalLexicalVar in `notifyWrite`:
+        because no "put" attempt succeeds here, the status WatchpointSet was ClearWatchpoint, we always go to the slow path, and we always throw the TDZ error
+        before configuring the WatchpointSet in the slow path. But after r241862, WatchpointSet is not used under non-JIT configuration. This skips WatchpointSet
+        check and LLInt32_64 starts failing tests because of lack of checkTDZInGlobalPutToScopeIfNecessary. This patch adds checkTDZInGlobalPutToScopeIfNecessary
+        in LLInt32_64 too. This patch fixes the following four failing tests.
+
+            stress/function-constructor-reading-from-global-lexical-environment.js.bytecode-cache
+            stress/function-constructor-reading-from-global-lexical-environment.js.default
+            stress/global-lexical-variable-tdz.js.bytecode-cache
+            stress/global-lexical-variable-tdz.js.default
+
+        * llint/LowLevelInterpreter32_64.asm:
+
 2019-02-25  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

@@ -2303 +2303 @@
     end
 
+    macro checkTDZInGlobalPutToScopeIfNecessary()
+        loadi OpPutToScope::Metadata::m_getPutInfo + GetPutInfo::m_operand[t5], t0
+        andi InitializationModeMask, t0
+        rshifti InitializationModeShift, t0
+        bineq t0, NotInitialization, .noNeedForTDZCheck
+        loadp OpPutToScope::Metadata::m_operand[t5], t0
+        loadi TagOffset[t0], t0
+        bieq t0, EmptyValueTag, .pDynamic
+    .noNeedForTDZCheck:
+    end
 
     metadata(t5, t0)
@@ -2330 +2340 @@
 .pGlobalLexicalVar:
     bineq t0, GlobalLexicalVar, .pClosureVar
+    checkTDZInGlobalPutToScopeIfNecessary()
     putGlobalVariable()
     writeBarrierOnGlobalLexicalEnvironment(size, get, m_value)
@@ -2358 +2369 @@
     bineq t0, GlobalLexicalVarWithVarInjectionChecks, .pClosureVarWithVarInjectionChecks
     varInjectionCheck(.pDynamic)
+    checkTDZInGlobalPutToScopeIfNecessary()
     putGlobalVariable()
     writeBarrierOnGlobalLexicalEnvironment(size, get, m_value)