Changeset 92148 in webkit

Timestamp:

Aug 1, 2011 3:32:07 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG JIT sometimes creates speculation check data structures that have
invalid information about the format of a register
​https://bugs.webkit.org/show_bug.cgi?id=65490

Reviewed by Gavin Barraclough.

The code now makes sure to (1) always have correct and up-to-date
information about register format at the time that a speculation
check is emitted, (2) assert that speculation data is correct
inside the speculation check implementation, and (3) avoid creating
speculation data altogether if compilation has already failed, since
at that point the format data is almost guaranteed to be bogus.

• dfg/DFGNonSpeculativeJIT.cpp:

(JSC::DFG::EntryLocation::EntryLocation):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculationCheck::SpeculationCheck):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::speculationCheck):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGNonSpeculativeJIT.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (5 diffs)
• dfg/DFGSpeculativeJIT.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT sometimes creates speculation check data structures that have
+        invalid information about the format of a register
+        https://bugs.webkit.org/show_bug.cgi?id=65490
+
+        Reviewed by Gavin Barraclough.
+        
+        The code now makes sure to (1) always have correct and up-to-date
+        information about register format at the time that a speculation
+        check is emitted, (2) assert that speculation data is correct
+        inside the speculation check implementation, and (3) avoid creating
+        speculation data altogether if compilation has already failed, since
+        at that point the format data is almost guaranteed to be bogus.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::EntryLocation::EntryLocation):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculationCheck::SpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+
 2011-08-01  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp

@@ -44 +44 @@
             m_gprInfo[iter.index()].nodeIndex = info.nodeIndex();
             m_gprInfo[iter.index()].format = info.registerFormat();
+            ASSERT(m_gprInfo[iter.index()].format != DataFormatNone);
             m_gprInfo[iter.index()].isSpilled = info.spillFormat() != DataFormatNone;
         } else

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -151 +151 @@
             m_gprInfo[iter.index()].nodeIndex = info.nodeIndex();
             m_gprInfo[iter.index()].format = info.registerFormat();
+            ASSERT(m_gprInfo[iter.index()].format != DataFormatNone);
             m_gprInfo[iter.index()].isSpilled = info.spillFormat() != DataFormatNone;
         } else
@@ -316 +317 @@
         m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
 
+        info.fillJSValue(gpr, DataFormatJS);
         if (info.spillFormat() != DataFormatJSCell)
             speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister));
@@ -685 +687 @@
                 int32_t imm2 = valueOfInt32Constant(node.child2());
                 GPRTemporary result(this);
-
+                
                 speculationCheck(m_jit.branchAdd32(MacroAssembler::Overflow, op1.gpr(), Imm32(imm2), result.gpr()));
 
@@ -904 +906 @@
         GPRReg propertyReg = property.gpr();
         GPRReg storageReg = storage.gpr();
+        
+        if (!m_compileOkay)
+            return;
 
         // Get the array storage. We haven't yet checked this is a JSArray, so this is only safe if
@@ -941 +946 @@
         if (!m_compileOkay)
             return;
-
+        
         writeBarrier(m_jit, baseReg, scratchReg);
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -187 +187 @@
     void speculationCheck(MacroAssembler::Jump jumpToFail)
     {
+        if (!m_compileOkay)
+            return;
         m_speculationChecks.append(SpeculationCheck(jumpToFail, this));
     }
@@ -192 +194 @@
     void speculationCheck(MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
     {
+        if (!m_compileOkay)
+            return;
         m_speculationRecoveryList.append(recovery);
         m_speculationChecks.append(SpeculationCheck(jumpToFail, this, m_speculationRecoveryList.size()));