Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (99621 => 99622)
--- trunk/Source/_javascript_Core/ChangeLog 2011-11-08 23:44:56 UTC (rev 99621)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-11-08 23:45:05 UTC (rev 99622)
@@ -77,6 +77,32 @@
2011-11-08 Gavin Barraclough <barraclo...@apple.com>
+ Fix PropertyAccessRecords in DFG JIT to take account of branch compaction.
+ https://bugs.webkit.org/show_bug.cgi?id=71855
+
+ Reviewed by Filip Pizlo.
+
+ The DFG JIT presently calculates a set of offsets early, before branches have been compacted.
+ This won't work on ARMv7.
+
+ * assembler/AbstractMacroAssembler.h:
+ (JSC::AbstractMacroAssembler::differenceBetweenCodePtr):
+ * assembler/LinkBuffer.h:
+ (JSC::LinkBuffer::locationOf):
+ * dfg/DFGJITCodeGenerator32_64.cpp:
+ (JSC::DFG::JITCodeGenerator::cachedGetById):
+ (JSC::DFG::JITCodeGenerator::cachedPutById):
+ * dfg/DFGJITCodeGenerator64.cpp:
+ (JSC::DFG::JITCodeGenerator::cachedGetById):
+ (JSC::DFG::JITCodeGenerator::cachedPutById):
+ * dfg/DFGJITCompiler.cpp:
+ (JSC::DFG::JITCompiler::link):
+ * dfg/DFGJITCompiler.h:
+ (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+ (JSC::DFG::JITCompiler::addPropertyAccess):
+
+2011-11-08 Gavin Barraclough <barraclo...@apple.com>
+
DFG JIT calculation of OSR entry points is not THUMB2 safe
https://bugs.webkit.org/show_bug.cgi?id=71852
Modified: trunk/Source/_javascript_Core/assembler/AbstractMacroAssembler.h (99621 => 99622)
--- trunk/Source/_javascript_Core/assembler/AbstractMacroAssembler.h 2011-11-08 23:44:56 UTC (rev 99621)
+++ trunk/Source/_javascript_Core/assembler/AbstractMacroAssembler.h 2011-11-08 23:45:05 UTC (rev 99622)
@@ -525,6 +525,11 @@
return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
}
+ static ptrdiff_t differenceBetweenCodePtr(const MacroAssemblerCodePtr& a, const MacroAssemblerCodePtr& b)
+ {
+ return reinterpret_cast<ptrdiff_t>(b.executableAddress()) - reinterpret_cast<ptrdiff_t>(a.executableAddress());
+ }
+
// Temporary interface; likely to be removed, since may be hard to port to all architectures.
#if CPU(X86) || CPU(X86_64)
void rewindToLabel(Label rewindTo) { m_assembler.rewindToLabel(rewindTo.m_label); }
Modified: trunk/Source/_javascript_Core/assembler/LinkBuffer.h (99621 => 99622)
--- trunk/Source/_javascript_Core/assembler/LinkBuffer.h 2011-11-08 23:44:56 UTC (rev 99621)
+++ trunk/Source/_javascript_Core/assembler/LinkBuffer.h 2011-11-08 23:45:05 UTC (rev 99622)
@@ -135,6 +135,11 @@
return CodeLocationNearCall(MacroAssembler::getLinkerAddress(code(), applyOffset(call.m_label)));
}
+ CodeLocationLabel locationOf(Jump jump)
+ {
+ return CodeLocationLabel(MacroAssembler::getLinkerAddress(code(), applyOffset(jump.m_label)));
+ }
+
CodeLocationLabel locationOf(Label label)
{
return CodeLocationLabel(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp (99621 => 99622)
--- trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp 2011-11-08 23:44:56 UTC (rev 99621)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp 2011-11-08 23:45:05 UTC (rev 99622)
@@ -881,15 +881,8 @@
JITCompiler::Label doneLabel = m_jit.label();
- int16_t checkImmToCall = safeCast<int16_t>(m_jit.differenceBetween(structureToCompare, functionCall));
- int16_t callToCheck = safeCast<int16_t>(m_jit.differenceBetween(functionCall, structureCheck));
- int16_t callToTagLoad = safeCast<int16_t>(m_jit.differenceBetween(functionCall, tagLoadWithPatch));
- int16_t callToPayloadLoad = safeCast<int16_t>(m_jit.differenceBetween(functionCall, payloadLoadWithPatch));
- int16_t callToSlowCase = safeCast<int16_t>(m_jit.differenceBetween(functionCall, slowCase));
- int16_t callToDone = safeCast<int16_t>(m_jit.differenceBetween(functionCall, doneLabel));
+ m_jit.addPropertyAccess(PropertyAccessRecord(structureToCompare, functionCall, structureCheck, tagLoadWithPatch, payloadLoadWithPatch, slowCase, doneLabel, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(resultTagGPR), safeCast<int8_t>(resultPayloadGPR), safeCast<int8_t>(scratchGPR)));
- m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToTagLoad, callToPayloadLoad, callToSlowCase, callToDone, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(resultTagGPR), safeCast<int8_t>(resultPayloadGPR), safeCast<int8_t>(scratchGPR));
-
return functionCall;
}
@@ -932,14 +925,7 @@
done.link(&m_jit);
JITCompiler::Label doneLabel = m_jit.label();
- int16_t checkImmToCall = safeCast<int16_t>(m_jit.differenceBetween(structureToCompare, functionCall));
- int16_t callToCheck = safeCast<int16_t>(m_jit.differenceBetween(functionCall, structureCheck));
- int16_t callToTagStore = safeCast<int16_t>(m_jit.differenceBetween(functionCall, tagStoreWithPatch));
- int16_t callToPayloadStore = safeCast<int16_t>(m_jit.differenceBetween(functionCall, payloadStoreWithPatch));
- int16_t callToSlowCase = safeCast<int16_t>(m_jit.differenceBetween(functionCall, slowCase));
- int16_t callToDone = safeCast<int16_t>(m_jit.differenceBetween(functionCall, doneLabel));
-
- m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToTagStore, callToPayloadStore, callToSlowCase, callToDone, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(valueTagGPR), safeCast<int8_t>(valuePayloadGPR), safeCast<int8_t>(scratchGPR));
+ m_jit.addPropertyAccess(PropertyAccessRecord(structureToCompare, functionCall, structureCheck, JITCompiler::DataLabelCompact(tagStoreWithPatch.label()), JITCompiler::DataLabelCompact(payloadStoreWithPatch.label()), slowCase, doneLabel, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(valueTagGPR), safeCast<int8_t>(valuePayloadGPR), safeCast<int8_t>(scratchGPR)));
}
void JITCodeGenerator::cachedGetMethod(GPRReg basePayloadGPR, GPRReg resultTagGPR, GPRReg resultPayloadGPR, GPRReg scratchGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget)
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator64.cpp (99621 => 99622)
--- trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator64.cpp 2011-11-08 23:44:56 UTC (rev 99621)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator64.cpp 2011-11-08 23:45:05 UTC (rev 99622)
@@ -807,14 +807,8 @@
JITCompiler::Label doneLabel = m_jit.label();
- int16_t checkImmToCall = safeCast<int16_t>(m_jit.differenceBetween(structureToCompare, functionCall));
- int16_t callToCheck = safeCast<int16_t>(m_jit.differenceBetween(functionCall, structureCheck));
- int16_t callToLoad = safeCast<int16_t>(m_jit.differenceBetween(functionCall, loadWithPatch));
- int16_t callToSlowCase = safeCast<int16_t>(m_jit.differenceBetween(functionCall, slowCase));
- int16_t callToDone = safeCast<int16_t>(m_jit.differenceBetween(functionCall, doneLabel));
+ m_jit.addPropertyAccess(PropertyAccessRecord(structureToCompare, functionCall, structureCheck, loadWithPatch, slowCase, doneLabel, safeCast<int8_t>(baseGPR), safeCast<int8_t>(resultGPR), safeCast<int8_t>(scratchGPR)));
- m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToLoad, callToSlowCase, callToDone, safeCast<int8_t>(baseGPR), safeCast<int8_t>(resultGPR), safeCast<int8_t>(scratchGPR));
-
if (scratchGPR != resultGPR && scratchGPR != InvalidGPRReg)
unlock(scratchGPR);
@@ -860,13 +854,7 @@
done.link(&m_jit);
JITCompiler::Label doneLabel = m_jit.label();
- int16_t checkImmToCall = safeCast<int16_t>(m_jit.differenceBetween(structureToCompare, functionCall));
- int16_t callToCheck = safeCast<int16_t>(m_jit.differenceBetween(functionCall, structureCheck));
- int16_t callToStore = safeCast<int16_t>(m_jit.differenceBetween(functionCall, storeWithPatch));
- int16_t callToSlowCase = safeCast<int16_t>(m_jit.differenceBetween(functionCall, slowCase));
- int16_t callToDone = safeCast<int16_t>(m_jit.differenceBetween(functionCall, doneLabel));
-
- m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToStore, callToSlowCase, callToDone, safeCast<int8_t>(baseGPR), safeCast<int8_t>(valueGPR), safeCast<int8_t>(scratchGPR));
+ m_jit.addPropertyAccess(PropertyAccessRecord(structureToCompare, functionCall, structureCheck, JITCompiler::DataLabelCompact(storeWithPatch.label()), slowCase, doneLabel, safeCast<int8_t>(baseGPR), safeCast<int8_t>(valueGPR), safeCast<int8_t>(scratchGPR)));
}
void JITCodeGenerator::cachedGetMethod(GPRReg baseGPR, GPRReg resultGPR, GPRReg scratchGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget)
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCompiler.cpp (99621 => 99622)
--- trunk/Source/_javascript_Core/dfg/DFGJITCompiler.cpp 2011-11-08 23:44:56 UTC (rev 99621)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCompiler.cpp 2011-11-08 23:45:05 UTC (rev 99622)
@@ -157,17 +157,18 @@
m_codeBlock->setNumberOfStructureStubInfos(m_propertyAccesses.size());
for (unsigned i = 0; i < m_propertyAccesses.size(); ++i) {
StructureStubInfo& info = m_codeBlock->structureStubInfo(i);
- info.callReturnLocation = linkBuffer.locationOf(m_propertyAccesses[i].m_functionCall);
- info.u.unset.deltaCheckImmToCall = m_propertyAccesses[i].m_deltaCheckImmToCall;
- info.deltaCallToStructCheck = m_propertyAccesses[i].m_deltaCallToStructCheck;
+ CodeLocationCall callReturnLocation = linkBuffer.locationOf(m_propertyAccesses[i].m_functionCall);
+ info.callReturnLocation = callReturnLocation;
+ info.u.unset.deltaCheckImmToCall = differenceBetweenCodePtr(linkBuffer.locationOf(m_propertyAccesses[i].m_deltaCheckImmToCall), callReturnLocation);
+ info.deltaCallToStructCheck = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_deltaCallToStructCheck));
#if USE(JSVALUE64)
- info.u.unset.deltaCallToLoadOrStore = m_propertyAccesses[i].m_deltaCallToLoadOrStore;
+ info.u.unset.deltaCallToLoadOrStore = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_deltaCallToLoadOrStore));
#else
- info.u.unset.deltaCallToTagLoadOrStore = m_propertyAccesses[i].m_deltaCallToTagLoadOrStore;
- info.u.unset.deltaCallToPayloadLoadOrStore = m_propertyAccesses[i].m_deltaCallToPayloadLoadOrStore;
+ info.u.unset.deltaCallToTagLoadOrStore = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_deltaCallToTagLoadOrStore));
+ info.u.unset.deltaCallToPayloadLoadOrStore = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_deltaCallToPayloadLoadOrStore));
#endif
- info.deltaCallToSlowCase = m_propertyAccesses[i].m_deltaCallToSlowCase;
- info.deltaCallToDone = m_propertyAccesses[i].m_deltaCallToDone;
+ info.deltaCallToSlowCase = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_deltaCallToSlowCase));
+ info.deltaCallToDone = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_deltaCallToDone));
info.baseGPR = m_propertyAccesses[i].m_baseGPR;
#if USE(JSVALUE64)
info.valueGPR = m_propertyAccesses[i].m_valueGPR;
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCompiler.h (99621 => 99622)
--- trunk/Source/_javascript_Core/dfg/DFGJITCompiler.h 2011-11-08 23:44:56 UTC (rev 99621)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCompiler.h 2011-11-08 23:45:05 UTC (rev 99622)
@@ -100,6 +100,51 @@
CodeOrigin m_codeOrigin;
};
+struct PropertyAccessRecord {
+#if USE(JSVALUE64)
+ PropertyAccessRecord(MacroAssembler::DataLabelPtr deltaCheckImmToCall, MacroAssembler::Call functionCall, MacroAssembler::Jump deltaCallToStructCheck, MacroAssembler::DataLabelCompact deltaCallToLoadOrStore, MacroAssembler::Label deltaCallToSlowCase, MacroAssembler::Label deltaCallToDone, int8_t baseGPR, int8_t valueGPR, int8_t scratchGPR)
+#elif USE(JSVALUE32_64)
+ PropertyAccessRecord(MacroAssembler::DataLabelPtr deltaCheckImmToCall, MacroAssembler::Call functionCall, MacroAssembler::Jump deltaCallToStructCheck, MacroAssembler::DataLabelCompact deltaCallToTagLoadOrStore, MacroAssembler::DataLabelCompact deltaCallToPayloadLoadOrStore, MacroAssembler::Label deltaCallToSlowCase, MacroAssembler::Label deltaCallToDone, int8_t baseGPR, int8_t valueTagGPR, int8_t valueGPR, int8_t scratchGPR)
+#endif
+ : m_deltaCheckImmToCall(deltaCheckImmToCall)
+ , m_functionCall(functionCall)
+ , m_deltaCallToStructCheck(deltaCallToStructCheck)
+#if USE(JSVALUE64)
+ , m_deltaCallToLoadOrStore(deltaCallToLoadOrStore)
+#elif USE(JSVALUE32_64)
+ , m_deltaCallToTagLoadOrStore(deltaCallToTagLoadOrStore)
+ , m_deltaCallToPayloadLoadOrStore(deltaCallToPayloadLoadOrStore)
+#endif
+ , m_deltaCallToSlowCase(deltaCallToSlowCase)
+ , m_deltaCallToDone(deltaCallToDone)
+ , m_baseGPR(baseGPR)
+#if USE(JSVALUE32_64)
+ , m_valueTagGPR(valueTagGPR)
+#endif
+ , m_valueGPR(valueGPR)
+ , m_scratchGPR(scratchGPR)
+ {
+ }
+
+ MacroAssembler::DataLabelPtr m_deltaCheckImmToCall;
+ MacroAssembler::Call m_functionCall;
+ MacroAssembler::Jump m_deltaCallToStructCheck;
+#if USE(JSVALUE64)
+ MacroAssembler::DataLabelCompact m_deltaCallToLoadOrStore;
+#elif USE(JSVALUE32_64)
+ MacroAssembler::DataLabelCompact m_deltaCallToTagLoadOrStore;
+ MacroAssembler::DataLabelCompact m_deltaCallToPayloadLoadOrStore;
+#endif
+ MacroAssembler::Label m_deltaCallToSlowCase;
+ MacroAssembler::Label m_deltaCallToDone;
+ int8_t m_baseGPR;
+#if USE(JSVALUE32_64)
+ int8_t m_valueTagGPR;
+#endif
+ int8_t m_valueGPR;
+ int8_t m_scratchGPR;
+};
+
// === JITCompiler ===
//
// DFG::JITCompiler is responsible for generating JIT code from the dataflow graph.
@@ -202,17 +247,10 @@
void emitStoreDouble(NodeIndex, FPRReg value);
#endif
-#if USE(JSVALUE64)
- void addPropertyAccess(JITCompiler::Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueGPR, int8_t scratchGPR)
+ void addPropertyAccess(const PropertyAccessRecord& record)
{
- m_propertyAccesses.append(PropertyAccessRecord(functionCall, deltaCheckImmToCall, deltaCallToStructCheck, deltaCallToLoadOrStore, deltaCallToSlowCase, deltaCallToDone, baseGPR, valueGPR, scratchGPR));
+ m_propertyAccesses.append(record);
}
-#elif USE(JSVALUE32_64)
- void addPropertyAccess(JITCompiler::Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToTagLoadOrStore, int16_t deltaCallToPayloadLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueTagGPR, int8_t valueGPR, int8_t scratchGPR)
- {
- m_propertyAccesses.append(PropertyAccessRecord(functionCall, deltaCheckImmToCall, deltaCallToStructCheck, deltaCallToTagLoadOrStore, deltaCallToPayloadLoadOrStore, deltaCallToSlowCase, deltaCallToDone, baseGPR, valueTagGPR, valueGPR, scratchGPR));
- }
-#endif
void addMethodGet(Call slowCall, DataLabelPtr structToCompare, DataLabelPtr protoObj, DataLabelPtr protoStructToCompare, DataLabelPtr putFunction)
{
@@ -275,51 +313,6 @@
// JIT code map for OSR entrypoints.
Label m_startOfCode;
- struct PropertyAccessRecord {
-#if USE(JSVALUE64)
- PropertyAccessRecord(Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueGPR, int8_t scratchGPR)
-#elif USE(JSVALUE32_64)
- PropertyAccessRecord(Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToTagLoadOrStore, int16_t deltaCallToPayloadLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueTagGPR, int8_t valueGPR, int8_t scratchGPR)
-#endif
- : m_functionCall(functionCall)
- , m_deltaCheckImmToCall(deltaCheckImmToCall)
- , m_deltaCallToStructCheck(deltaCallToStructCheck)
-#if USE(JSVALUE64)
- , m_deltaCallToLoadOrStore(deltaCallToLoadOrStore)
-#elif USE(JSVALUE32_64)
- , m_deltaCallToTagLoadOrStore(deltaCallToTagLoadOrStore)
- , m_deltaCallToPayloadLoadOrStore(deltaCallToPayloadLoadOrStore)
-#endif
- , m_deltaCallToSlowCase(deltaCallToSlowCase)
- , m_deltaCallToDone(deltaCallToDone)
- , m_baseGPR(baseGPR)
-#if USE(JSVALUE32_64)
- , m_valueTagGPR(valueTagGPR)
-#endif
- , m_valueGPR(valueGPR)
- , m_scratchGPR(scratchGPR)
- {
- }
-
- JITCompiler::Call m_functionCall;
- int16_t m_deltaCheckImmToCall;
- int16_t m_deltaCallToStructCheck;
-#if USE(JSVALUE64)
- int16_t m_deltaCallToLoadOrStore;
-#elif USE(JSVALUE32_64)
- int16_t m_deltaCallToTagLoadOrStore;
- int16_t m_deltaCallToPayloadLoadOrStore;
-#endif
- int16_t m_deltaCallToSlowCase;
- int16_t m_deltaCallToDone;
- int8_t m_baseGPR;
-#if USE(JSVALUE32_64)
- int8_t m_valueTagGPR;
-#endif
- int8_t m_valueGPR;
- int8_t m_scratchGPR;
- };
-
struct MethodGetRecord {
MethodGetRecord(Call slowCall, DataLabelPtr structToCompare, DataLabelPtr protoObj, DataLabelPtr protoStructToCompare, DataLabelPtr putFunction)
: m_slowCall(slowCall)