Changeset 246240 in webkit


Ignore:
Timestamp:
Jun 9, 2019 1:28:18 PM (5 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r246150, r246160, and r246166.
​https://bugs.webkit.org/show_bug.cgi?id=198698

Regresses page loading time on iOS 13 (Requested by keith_m
on #webkit).

Reverted changesets:

"Reenable Gigacage on ARM64."
​https://bugs.webkit.org/show_bug.cgi?id=198453
​https://trac.webkit.org/changeset/246150

"Unrevied build fix for FTL without Gigacage."
​https://trac.webkit.org/changeset/246160

"Fix typo in cageWithoutUntagging"
​https://bugs.webkit.org/show_bug.cgi?id=198617
​https://trac.webkit.org/changeset/246166

Location:
trunk/Source
Files:
20 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r246237 r246240  
     12019-06-09  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r246150, r246160, and r246166.
     4        https://bugs.webkit.org/show_bug.cgi?id=198698
     5
     6        Regresses page loading time on iOS 13 (Requested by keith_m__
     7        on #webkit).
     8
     9        Reverted changesets:
     10
     11        "Reenable Gigacage on ARM64."
     12        https://bugs.webkit.org/show_bug.cgi?id=198453
     13        https://trac.webkit.org/changeset/246150
     14
     15        "Unrevied build fix for FTL without Gigacage."
     16        https://trac.webkit.org/changeset/246160
     17
     18        "Fix typo in cageWithoutUntagging"
     19        https://bugs.webkit.org/show_bug.cgi?id=198617
     20        https://trac.webkit.org/changeset/246166
     21
    1222019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>
    223

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h

    r246150 r246240  
    25272527    }
    25282528
    2529     // Bit field operations:
    2530 
    2531     // destBitOffset is the top bit of the destination where the bits should be copied to. Zero is the lowest order bit.
    2532     void bitFieldInsert64(RegisterID source, unsigned destBitOffset, unsigned width, RegisterID dest)
    2533     {
    2534         ASSERT(width <= 64 - destBitOffset && destBitOffset < 64);
    2535         m_assembler.bfi<64>(dest, source, destBitOffset, width);
    2536     }
    2537 
    25382529    // Forwards / external control flow operations:
    25392530    //

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h

    r246150 r246240  
    4040class MacroAssemblerARM64E : public MacroAssemblerARM64 {
    4141public:
    42     static constexpr unsigned numberOfPACBits = 25;
    43 
    4442    ALWAYS_INLINE void tagReturnAddress()
    4543    {

  • trunk/Source/JavaScriptCore/assembler/testmasm.cpp

    r246166 r246240  
    4040#include <wtf/Lock.h>
    4141#include <wtf/NumberOfCores.h>
    42 #include <wtf/PtrTag.h>
    4342#include <wtf/Threading.h>
    4443#include <wtf/text/StringCommon.h>
    … …  
    108107        dataLog("FAILED while testing " #_actual ": expected: ", _expected, ", actual: ", _actual, "\n"); \
    109108        WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, "CHECK_EQ("#_actual ", " #_expected ")"); \
    110         CRASH();                                                        \
    111     } while (false)
    112 
    113 #define CHECK_NOT_EQ(_actual, _expected) do {                               \
    114         if ((_actual) != (_expected))                                   \
    115             break;                                                      \
    116         crashLock.lock();                                               \
    117         dataLog("FAILED while testing " #_actual ": expected not: ", _expected, ", actual: ", _actual, "\n"); \
    118         WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, "CHECK_NOT_EQ("#_actual ", " #_expected ")"); \
    119109        CRASH();                                                        \
    120110    } while (false)
    … …  
    10121002
    10131003#endif
    1014 }
    1015 
    1016 static void testCagePreservesPACFailureBit()
    1017 {
    1018     auto cage = compile([] (CCallHelpers& jit) {
    1019         jit.emitFunctionPrologue();
    1020         jit.cageConditionally(Gigacage::Primitive, GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::argumentGPR2);
    1021         jit.move(GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
    1022         jit.emitFunctionEpilogue();
    1023         jit.ret();
    1024     });
    1025 
    1026     void* ptr = Gigacage::tryMalloc(Gigacage::Primitive, 1);
    1027     void* taggedPtr = tagArrayPtr(ptr, 1);
    1028     dataLogLn("starting test");
    1029     if (isARM64E()) {
    1030         // FIXME: This won't work if authentication failures trap but I don't know how to test for that right now.
    1031         CHECK_NOT_EQ(invoke<void*>(cage, taggedPtr, 2), ptr);
    1032     } else
    1033         CHECK_EQ(invoke<void*>(cage, taggedPtr, 2), ptr);
    1034 
    1035     CHECK_EQ(invoke<void*>(cage, taggedPtr, 1), ptr);
    1036 
    1037     auto cageWithoutAuthentication = compile([] (CCallHelpers& jit) {
    1038         jit.emitFunctionPrologue();
    1039         jit.cageWithoutUntagging(Gigacage::Primitive, GPRInfo::argumentGPR0);
    1040         jit.move(GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
    1041         jit.emitFunctionEpilogue();
    1042         jit.ret();
    1043     });
    1044 
    1045     if (isARM64E()) {
    1046         // FIXME: This won't work if authentication failures trap but I don't know how to test for that right now.
    1047         CHECK_NOT_EQ(invoke<void*>(cageWithoutAuthentication, untagArrayPtr(taggedPtr, 2)), ptr);
    1048     } else
    1049         CHECK_EQ(invoke<void*>(cageWithoutAuthentication, untagArrayPtr(taggedPtr, 2)), ptr);
    1050 
    1051     CHECK_EQ(untagArrayPtr(taggedPtr, 1), ptr);
    1052     CHECK_EQ(invoke<void*>(cageWithoutAuthentication, untagArrayPtr(taggedPtr, 1)), ptr);
    1053 
    1054     Gigacage::free(Gigacage::Primitive, ptr);
    10551004}
    10561005
    … …  
    11401089    RUN(testMoveDoubleConditionally64());
    11411090
    1142     RUN(testCagePreservesPACFailureBit());
    1143 
    11441091    if (tasks.isEmpty())
    11451092        usage();

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r246166 r246240  
    28742874
    28752875            JITCompiler::Jump hasNullVector;
    2876 #if CPU(ARM64E)
     2876#if !GIGACAGE_ENABLED && CPU(ARM64E)
    28772877            {
    28782878                GPRReg scratch = m_jit.scratchRegister();
    … …  
    28832883                hasNullVector = m_jit.branchTestPtr(MacroAssembler::Zero, scratch);
    28842884            }
    2885 #else // CPU(ARM64E)
     2885#else // !GIGACAGE_ENABLED && CPU(ARM64E)
    28862886            hasNullVector = m_jit.branchTestPtr(
    28872887                MacroAssembler::Zero,
    … …  
    67616761void SpeculativeJIT::cageTypedArrayStorage(GPRReg baseReg, GPRReg storageReg)
    67626762{
    6763 #if CPU(ARM64E)
    6764     m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
    6765 #else
    6766     UNUSED_PARAM(baseReg);
    6767     UNUSED_PARAM(storageReg);
    6768 #endif
    6769 
    67706763#if GIGACAGE_ENABLED
    67716764    UNUSED_PARAM(baseReg);
    … …  
    67806773    }
    67816774   
    6782     m_jit.cageWithoutUntagging(Gigacage::Primitive, storageReg);
     6775    m_jit.cage(Gigacage::Primitive, storageReg);
     6776#elif CPU(ARM64E)
     6777    m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
     6778#else
     6779    UNUSED_PARAM(baseReg);
     6780    UNUSED_PARAM(storageReg);
    67836781#endif
    67846782}
    … …  
    68446842
    68456843    m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), dataGPR);
    6846     m_jit.cageWithoutUntagging(Gigacage::JSValue, dataGPR);
     6844    m_jit.cage(Gigacage::JSValue, dataGPR);
    68476845
    68486846    cageTypedArrayStorage(baseGPR, vectorGPR);
    … …  
    98489846    m_jit.branchTest32(MacroAssembler::NonZero, scratchGPR).linkTo(loop, &m_jit);
    98499847    done.link(&m_jit);
    9850 #if CPU(ARM64E)
     9848#if !GIGACAGE_ENABLED && CPU(ARM64E)
    98519849    // sizeGPR is still boxed as a number and there is no 32-bit variant of the PAC instructions.
    98529850    m_jit.zeroExtend32ToPtr(sizeGPR, scratchGPR);

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r246160 r246240  
    64866486                m_heaps.typedArrayProperties);
    64876487
    6488 #if CPU(ARM64E)
     6488#if !GIGACAGE_ENABLED && CPU(ARM64E)
    64896489            {
    64906490                LValue sizePtr = m_out.zeroExtPtr(size);
    … …  
    1415814158    LValue caged(Gigacage::Kind kind, LValue ptr, LValue base)
    1415914159    {
    14160 #if CPU(ARM64E)
    14161         if (kind == Gigacage::Primitive) {
    14162             LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
    14163             ptr = untagArrayPtr(ptr, size);
    14164         }
    14165 #else
    14166         UNUSED_PARAM(kind);
    14167         UNUSED_PARAM(base);
    14168 #endif
    14169 
    1417014160#if GIGACAGE_ENABLED
    1417114161        UNUSED_PARAM(base);
    … …  
    1418614176        LValue result = m_out.add(masked, basePtr);
    1418714177
    14188 #if CPU(ARM64E)
    14189         {
    14190             PatchpointValue* merge = m_out.patchpoint(pointerType());
    14191             merge->append(result, B3::ValueRep(B3::ValueRep::SomeLateRegister));
    14192             merge->appendSomeRegister(ptr);
    14193             merge->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
    14194                 jit.move(params[2].gpr(), params[0].gpr());
    14195                 jit.bitFieldInsert64(params[1].gpr(), 0, 64 - MacroAssembler::numberOfPACBits, params[0].gpr());
    14196             });
    14197             result = merge;
    14198         }
    14199 #endif
    1420014178        // Make sure that B3 doesn't try to do smart reassociation of these pointer bits.
    1420114179        // FIXME: In an ideal world, B3 would not do harmful reassociations, and if it did, it would be able
    … …  
    1421014188        // https://bugs.webkit.org/show_bug.cgi?id=175493
    1421114189        return m_out.opaque(result);
     14190#elif CPU(ARM64E)
     14191        if (kind == Gigacage::Primitive) {
     14192            LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
     14193            return untagArrayPtr(ptr, size);
     14194        }
     14195
     14196        return ptr;
     14197#else
     14198        UNUSED_PARAM(kind);
     14199        UNUSED_PARAM(base);
     14200        return ptr;
    1421214201#endif
    14213         return ptr;
    1421414202    }
    1421514203   

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

    r246166 r246240  
    15551555        ok.link(this);
    15561556    }
    1557 
    1558     void cageWithoutUntagging(Gigacage::Kind kind, GPRReg storage)
     1557   
     1558    void cage(Gigacage::Kind kind, GPRReg storage)
    15591559    {
    15601560#if GIGACAGE_ENABLED
    15611561        if (!Gigacage::isEnabled(kind))
    15621562            return;
    1563 
    1564 #if CPU(ARM64E)
    1565         RegisterID tempReg = InvalidGPRReg;
    1566         if (kind == Gigacage::Primitive) {
    1567             tempReg = getCachedMemoryTempRegisterIDAndInvalidate();
    1568             move(storage, tempReg);
    1569             // Flip the registers since bitFieldInsert only inserts into the low bits.
    1570             std::swap(storage, tempReg);
    1571         }
    1572 #endif
     1563       
    15731564        andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
    15741565        addPtr(TrustedImmPtr(Gigacage::basePtr(kind)), storage);
    1575 #if CPU(ARM64E)
    1576         if (kind == Gigacage::Primitive)
    1577             bitFieldInsert64(storage, 0, 64 - numberOfPACBits, tempReg);
    1578 #endif
    1579 
    15801566#else
    15811567        UNUSED_PARAM(kind);
    … …  
    15831569#endif
    15841570    }
    1585 
    1586     // length may be the same register as scratch.
    1587     void cageConditionally(Gigacage::Kind kind, GPRReg storage, GPRReg length, GPRReg scratch)
    1588     {
    1589 #if CPU(ARM64E)
    1590         if (kind == Gigacage::Primitive)
    1591             untagArrayPtr(length, storage);
    1592 #else
    1593         UNUSED_PARAM(kind);
    1594         UNUSED_PARAM(storage);
    1595         UNUSED_PARAM(length);
    1596 #endif
    1597 
     1571   
     1572    void cageConditionally(Gigacage::Kind kind, GPRReg storage, GPRReg scratchOrLength)
     1573    {
    15981574#if GIGACAGE_ENABLED
    15991575        if (!Gigacage::isEnabled(kind))
    … …  
    16011577       
    16021578        if (kind != Gigacage::Primitive || Gigacage::isDisablingPrimitiveGigacageDisabled())
    1603             cageWithoutUntagging(kind, storage);
    1604         else {
    1605             loadPtr(&Gigacage::basePtr(kind), scratch);
    1606             Jump done = branchTestPtr(Zero, scratch);
    1607 #if CPU(ARM64E)
    1608             auto tempReg = getCachedMemoryTempRegisterIDAndInvalidate();
    1609             move(storage, tempReg);
    1610             andPtr(TrustedImmPtr(Gigacage::mask(kind)), tempReg);
    1611             addPtr(scratch, tempReg);
    1612             bitFieldInsert64(tempReg, 0, 64 - numberOfPACBits, storage);
    1613 #else
    1614             andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
    1615             addPtr(scratch, storage);
    1616 #endif
    1617             done.link(this);
    1618 
    1619 
    1620         }
    1621 #else
    1622         UNUSED_PARAM(scratch);
    1623 #endif
    1624 
     1579            return cage(kind, storage);
     1580       
     1581        loadPtr(&Gigacage::basePtr(kind), scratchOrLength);
     1582        Jump done = branchTestPtr(Zero, scratchOrLength);
     1583        andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
     1584        addPtr(scratchOrLength, storage);
     1585        done.link(this);
     1586#elif CPU(ARM64E)
     1587        if (kind == Gigacage::Primitive)
     1588            untagArrayPtr(scratchOrLength, storage);
     1589#else
     1590        UNUSED_PARAM(kind);
     1591        UNUSED_PARAM(storage);
     1592        UNUSED_PARAM(scratchOrLength);
     1593#endif
    16251594    }
    16261595

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r246150 r246240  
    16731673    slowCases.append(branch32(AboveOrEqual, property, scratch2));
    16741674    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
    1675     cageConditionally(Gigacage::Primitive, scratch, scratch2, scratch2);
     1675    cageConditionally(Gigacage::Primitive, scratch, scratch2);
    16761676
    16771677    switch (elementSize(type)) {
    … …  
    17371737    slowCases.append(branch32(AboveOrEqual, property, scratch2));
    17381738    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
    1739     cageConditionally(Gigacage::Primitive, scratch, scratch2, scratch2);
     1739    cageConditionally(Gigacage::Primitive, scratch, scratch2);
    17401740   
    17411741    switch (elementSize(type)) {
    … …  
    18021802    // path expects the base to be unclobbered.
    18031803    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
    1804     cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2, lateScratch2);
     1804    cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2);
    18051805   
    18061806    if (isClamped(type)) {
    … …  
    18911891    // path expects the base to be unclobbered.
    18921892    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
    1893     cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2, lateScratch2);
     1893    cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2);
    18941894   
    18951895    switch (elementSize(type)) {

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r246150 r246240  
    7777#  - pc holds the (native) program counter on 32-bits ARM architectures (ARMv7)
    7878#
    79 #  - t0, t1, t2, t3, t4, and optionally t5, t6, and t7 are temporary registers that can get trashed on
     79#  - t0, t1, t2, t3, t4 and optionally t5 are temporary registers that can get trashed on
    8080#  calls, and are pairwise distinct registers. t4 holds the JS program counter, so use
    8181#  with caution in opcodes (actually, don't use it in opcodes at all, except as PC).

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r246150 r246240  
    435435macro loadCagedPrimitive(source, dest, scratchOrLength)
    436436    loadp source, dest
    437     if ARM64E
    438         const result = t7
     437    if GIGACAGE_ENABLED
     438        uncage(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr Gigacage::primitiveGigacageMask, dest, scratchOrLength)
     439    elsif ARM64E
    439440        untagArrayPtr scratchOrLength, dest
    440         move dest, result
    441     else
    442         const result = dest
    443     end
    444     if GIGACAGE_ENABLED
    445         uncage(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr Gigacage::primitiveGigacageMask, result, scratchOrLength)
    446         if ARM64E
    447             const numberOfPACBits = constexpr MacroAssembler::numberOfPACBits
    448             bfiq result, 0, 64 - numberOfPACBits, dest
    449         end
    450441    end
    451442end

  • trunk/Source/JavaScriptCore/offlineasm/arm64.rb

    r246150 r246240  
    127127        when 't6'
    128128          arm64GPRName('x6', kind)
    129         when 't7'
    130           arm64GPRName('x7', kind)
    131129        when 'cfr'
    132130            arm64GPRName('x29', kind)
    … …  
    10221020        when "memfence"
    10231021            $asm.puts "dmb sy"
    1024         when "bfiq"
    1025             $asm.puts "bfi #{operands[3].arm64Operand(:quad)}, #{operands[0].arm64Operand(:quad)}, #{operands[1].value}, #{operands[2].value}"
    10261022        when "pcrtoaddr"
    10271023            $asm.puts "adr #{operands[1].arm64Operand(:quad)}, #{operands[0].value}"

  • trunk/Source/JavaScriptCore/offlineasm/instructions.rb

    r246150 r246240  
    274274ARM64_INSTRUCTIONS =
    275275    [
    276      "bfiq", # Bit field insert <source reg> <last bit written> <width immediate> <dest reg>
    277276     "pcrtoaddr",   # Address from PC relative offset - adr instruction
    278277     "nopFixCortexA53Err835769", # nop on Cortex-A53 (nothing otherwise)

  • trunk/Source/JavaScriptCore/offlineasm/registers.rb

    r246150 r246240  
    3333     "t5",
    3434     "t6",
    35      "t7",
    3635     "cfr",
    3736     "a0",

  • trunk/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp

    r246150 r246240  
    849849
    850850        patchpoint->setGenerator([pinnedRegs] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
    851             AllowMacroScratchRegisterUsage allowScratch(jit);
     851            RELEASE_ASSERT(!Gigacage::isEnabled(Gigacage::Primitive) || !isARM64());
     852            AllowMacroScratchRegisterUsageIf allowScratch(jit, !isARM64());
    852853            GPRReg baseMemory = pinnedRegs->baseMemoryPointer;
    853854            GPRReg scratchOrSize = Gigacage::isEnabled(Gigacage::Primitive) ? params.gpScratch(0) : pinnedRegs->sizeRegister;
    … …  
    856857            jit.loadPtr(CCallHelpers::Address(params[0].gpr(), Instance::offsetOfCachedMemory()), baseMemory);
    857858
    858             jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs->sizeRegister, scratchOrSize);
     859            jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
    859860        });
    860861
    … …  
    19881989            jit.loadPtr(CCallHelpers::Address(newContextInstance, Instance::offsetOfCachedMemory()), baseMemory); // Memory::void*.
    19891990
    1990             jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs.sizeRegister, scratchOrSize);
     1991            jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
    19911992        });
    19921993

  • trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp

    r246150 r246240  
    492492        patchpoint->append(instance, ValueRep::SomeRegister);
    493493        patchpoint->setGenerator([pinnedRegs] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
    494             AllowMacroScratchRegisterUsage allowScratch(jit);
     494            RELEASE_ASSERT(!Gigacage::isEnabled(Gigacage::Primitive) || !isARM64());
     495            AllowMacroScratchRegisterUsageIf allowScratch(jit, !isARM64());
    495496            GPRReg baseMemory = pinnedRegs->baseMemoryPointer;
    496497            GPRReg scratchOrSize = Gigacage::isEnabled(Gigacage::Primitive) ? params.gpScratch(0) : pinnedRegs->sizeRegister;
    … …  
    499500            jit.loadPtr(CCallHelpers::Address(params[0].gpr(), Instance::offsetOfCachedMemory()), baseMemory);
    500501
    501             jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs->sizeRegister, scratchOrSize);
     502            jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
    502503        });
    503504    }
    … …  
    14011402            jit.loadPtr(CCallHelpers::Address(newContextInstance, Instance::offsetOfCachedMemory()), baseMemory); // Memory::void*.
    14021403
    1403             jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs.sizeRegister, scratchOrSize);
     1404            jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
    14041405        });
    14051406        doContextSwitch->appendNewControlValue(m_proc, Jump, origin(), continuation);

  • trunk/Source/JavaScriptCore/wasm/WasmBinding.cpp

    r246150 r246240  
    6868    // Set up the callee's baseMemory register as well as the memory size registers.
    6969    {
    70         GPRReg scratchOrSize = !Gigacage::isEnabled(Gigacage::Primitive) ? pinnedRegs.sizeRegister : wasmCallingConventionAir().prologueScratch(1);
     70        GPRReg scratchOrSize = isARM64E() ? pinnedRegs.sizeRegister : wasmCallingConventionAir().prologueScratch(1);
    7171
    7272        jit.loadPtr(JIT::Address(baseMemory, Wasm::Instance::offsetOfCachedMemorySize()), pinnedRegs.sizeRegister); // Memory size.
    7373        jit.loadPtr(JIT::Address(baseMemory, Wasm::Instance::offsetOfCachedMemory()), baseMemory); // Wasm::Memory::TaggedArrayStoragePtr<void> (void*).
    74         jit.cageConditionally(Gigacage::Primitive, baseMemory, pinnedRegs.sizeRegister, scratchOrSize);
     74        jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
    7575    }
    7676

  • trunk/Source/JavaScriptCore/wasm/js/JSToWasm.cpp

    r246150 r246240  
    229229
    230230        jit.loadPtr(CCallHelpers::Address(currentInstanceGPR, Wasm::Instance::offsetOfCachedMemory()), baseMemory);
    231         jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize, scratchOrSize);
     231        jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
    232232    }
    233233

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp

    r246150 r246240  
    424424
    425425        jit.loadPtr(CCallHelpers::Address(scratchGPR, Wasm::Instance::offsetOfCachedMemory()), baseMemory);
    426         jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize, scratchOrSize);
     426        jit.cageConditionally(Gigacage::Primitive, baseMemory, scratchOrSize);
    427427    }
    428428

  • trunk/Source/bmalloc/ChangeLog

    r246150 r246240  
     12019-06-09  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r246150, r246160, and r246166.
     4        https://bugs.webkit.org/show_bug.cgi?id=198698
     5
     6        Regresses page loading time on iOS 13 (Requested by keith_m__
     7        on #webkit).
     8
     9        Reverted changesets:
     10
     11        "Reenable Gigacage on ARM64."
     12        https://bugs.webkit.org/show_bug.cgi?id=198453
     13        https://trac.webkit.org/changeset/246150
     14
     15        "Unrevied build fix for FTL without Gigacage."
     16        https://trac.webkit.org/changeset/246160
     17
     18        "Fix typo in cageWithoutUntagging"
     19        https://bugs.webkit.org/show_bug.cgi?id=198617
     20        https://trac.webkit.org/changeset/246166
     21
    1222019-06-06  Keith Miller  <keith_miller@apple.com>
    223

  • trunk/Source/bmalloc/bmalloc/Gigacage.h

    r246150 r246240  
    3535#include <inttypes.h>
    3636
    37 #if ((BOS(DARWIN) || BOS(LINUX)) && \
    38     (BCPU(X86_64) || (BCPU(ARM64) && !defined(__ILP32__) && (!BPLATFORM(IOS_FAMILY) || BPLATFORM(IOS)))))
     37#if ((BOS(DARWIN) || BOS(LINUX)) && BCPU(X86_64))
    3938#define GIGACAGE_ENABLED 1
    4039#else
Note: See TracChangeset for help on using the changeset viewer.