Changeset 252975 in webkit

Timestamp:

Dec 1, 2019 6:57:43 PM (4 years ago)

Author:

Caio Lima

Message:

[JSC][MIPS] CallFrame is being clobbered on InternalFunction execution
​https://bugs.webkit.org/show_bug.cgi?id=203739

Reviewed by Saam Barati.

JSTests:

• stress/has-instance-exception-check.js:
• stress/regress-176485.js:

Source/JavaScriptCore:

MIPS calling conventions requires that we have stack space reserved
for 4 (16-bytes) arguments ($a0-$a3). The caller doesn't use
this space, but callee can still use it in case where they need to save
arguments or even reuse to another allocation. Since we were not
allocationg it during makeHostFunctionCall, the caller frame slot
was being clobberred by callGenericTypedArrayView execution,
resulting in a corrupted call frame stack. This patch is adjusting
this convention into ThunkGenerator and on makeHostFunctionCall.

• jit/ThunkGenerators.cpp:

(JSC::nativeForGenerator):

• llint/LowLevelInterpreter32_64.asm:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/has-instance-exception-check.js (modified) (1 diff)
• JSTests/stress/regress-176485.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jit/ThunkGenerators.cpp (modified) (2 diffs)
• Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-12-01  Caio Lima  <ticaiolima@gmail.com>
+
+        [JSC][MIPS] CallFrame is being clobbered on InternalFunction execution
+        https://bugs.webkit.org/show_bug.cgi?id=203739
+
+        Reviewed by Saam Barati.
+
+        * stress/has-instance-exception-check.js:
+        * stress/regress-176485.js:
+
 2019-11-30  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/JSTests/stress/has-instance-exception-check.js

@@ -1 @@
-//@ skip if $architecture == "mips"
-
 function assert(b) {
     if (!b)

trunk/JSTests/stress/regress-176485.js

@@ -1 @@
-//@ skip if $architecture == "mips"
-
 var exception;
 try {

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-12-01  Caio Lima  <ticaiolima@gmail.com>
+
+        [JSC][MIPS] CallFrame is being clobbered on InternalFunction execution
+        https://bugs.webkit.org/show_bug.cgi?id=203739
+
+        Reviewed by Saam Barati.
+
+        MIPS calling conventions requires that we have stack space reserved
+        for 4 (16-bytes) arguments ($a0-$a3). The caller doesn't use
+        this space, but callee can still use it in case where they need to save
+        arguments or even reuse to another allocation. Since we were not
+        allocationg it during `makeHostFunctionCall`, the caller frame slot
+        was being clobberred by `callGenericTypedArrayView` execution,
+        resulting in a corrupted call frame stack. This patch is adjusting
+        this convention into ThunkGenerator and on  `makeHostFunctionCall`.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * llint/LowLevelInterpreter32_64.asm:
+
 2019-12-01  Caio Lima  <ticaiolima@gmail.com>
 

trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

@@ -327 +327 @@
     // Allocate space on stack for the 4 parameter registers.
     jit.subPtr(JSInterfaceJIT::TrustedImm32(4 * sizeof(int64_t)), JSInterfaceJIT::stackPointerRegister);
+#elif CPU(MIPS)
+    // Allocate stack space for (unused) 16 bytes (8-byte aligned) for 4 arguments.
+    jit.subPtr(CCallHelpers::TrustedImm32(16), CCallHelpers::stackPointerRegister);
 #endif
     jit.move(CCallHelpers::TrustedImmPtr(&vm), JSInterfaceJIT::argumentGPR0);
@@ -333 +336 @@
 #if OS(WINDOWS)
     jit.addPtr(JSInterfaceJIT::TrustedImm32(4 * sizeof(int64_t)), JSInterfaceJIT::stackPointerRegister);
+#elif CPU(MIPS)
+    jit.addPtr(CCallHelpers::TrustedImm32(16), CCallHelpers::stackPointerRegister);
 #endif
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

@@ -353 +353 @@
         call temp1
         addp 8, sp
+    elsif MIPS
+        move sp, a1
+        # We need to allocate stack space for 16 bytes (8-byte aligned)
+        # for 4 arguments, since callee can use this space.
+        subp 16, sp 
+        loadp ProtoCallFrame::globalObject[protoCallFrame], a0
+        call temp1
+        addp 16, sp
     else
         loadp ProtoCallFrame::globalObject[protoCallFrame], a0