Changeset 245084 in webkit

Timestamp:

May 8, 2019 5:49:35 PM (5 years ago)

Author:

sbarati@apple.com

Message:

AccessGenerationState::emitExplicitExceptionHandler can clobber an in use register
​https://bugs.webkit.org/show_bug.cgi?id=197715
<rdar://problem/50399252>

Reviewed by Filip Pizlo.

JSTests:

• stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js: Added.

(foo):
(bar):

Source/JavaScriptCore:

AccessGenerationState::emitExplicitExceptionHandler was always clobbering
x86's r9 without considering if that register was needed to be preserved
by the IC. This leads to bad things when the DFG/FTL need that register when
OSR exitting after an exception from a GetById call.

• b3/air/AirCode.cpp:

(JSC::B3::Air::Code::Code):

• bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::emitExplicitExceptionHandler):

• runtime/Options.h:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/b3/air/AirCode.cpp (modified) (1 diff)
• Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (modified) (1 diff)
• Source/JavaScriptCore/runtime/Options.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-05-08  Saam barati  <sbarati@apple.com>
+
+        AccessGenerationState::emitExplicitExceptionHandler can clobber an in use register
+        https://bugs.webkit.org/show_bug.cgi?id=197715
+        <rdar://problem/50399252>
+
+        Reviewed by Filip Pizlo.
+
+        * stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js: Added.
+        (foo):
+        (bar):
+
 2019-05-08  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-08  Saam barati  <sbarati@apple.com>
+
+        AccessGenerationState::emitExplicitExceptionHandler can clobber an in use register
+        https://bugs.webkit.org/show_bug.cgi?id=197715
+        <rdar://problem/50399252>
+
+        Reviewed by Filip Pizlo.
+
+        AccessGenerationState::emitExplicitExceptionHandler was always clobbering
+        x86's r9 without considering if that register was needed to be preserved
+        by the IC. This leads to bad things when the DFG/FTL need that register when
+        OSR exitting after an exception from a GetById call.
+
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::Code):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
+        * runtime/Options.h:
+
 2019-05-08  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/JavaScriptCore/b3/air/AirCode.cpp

@@ -80 +80 @@
                 });
             if (Options::airRandomizeRegs()) {
-                shuffleVector(volatileRegs, [&] (unsigned limit) { return m_weakRandom.getUint32(limit); });
-                shuffleVector(calleeSaveRegs, [&] (unsigned limit) { return m_weakRandom.getUint32(limit); });
+                WeakRandom random(Options::airRandomizeRegsSeed() ? Options::airRandomizeRegsSeed() : m_weakRandom.getUint32());
+                shuffleVector(volatileRegs, [&] (unsigned limit) { return random.getUint32(limit); });
+                shuffleVector(calleeSaveRegs, [&] (unsigned limit) { return random.getUint32(limit); });
             }
             Vector<Reg> result;

trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp

@@ -180 +180 @@
 {
     restoreScratch();
-    jit->copyCalleeSavesToEntryFrameCalleeSavesBuffer(m_vm.topEntryFrame);
+    jit->pushToSave(GPRInfo::regT0);
+    jit->loadPtr(&m_vm.topEntryFrame, GPRInfo::regT0);
+    jit->copyCalleeSavesToEntryFrameCalleeSavesBuffer(GPRInfo::regT0);
+    jit->popToRestore(GPRInfo::regT0);
+
     if (needsToRestoreRegistersIfException()) {
         // To the JIT that produces the original exception handling

trunk/Source/JavaScriptCore/runtime/Options.h

@@ -446 +446 @@
     v(bool, airForceIRCAllocator, false, Normal, nullptr) \
     v(bool, airRandomizeRegs, false, Normal, nullptr) \
+    v(unsigned, airRandomizeRegsSeed, 0, Normal, nullptr) \
     v(bool, coalesceSpillSlots, true, Normal, nullptr) \
     v(bool, logAirRegisterPressure, false, Normal, nullptr) \