Modified: trunk/JSTests/ChangeLog (274698 => 274699)
--- trunk/JSTests/ChangeLog 2021-03-19 02:56:02 UTC (rev 274698)
+++ trunk/JSTests/ChangeLog 2021-03-19 04:20:11 UTC (rev 274699)
@@ -1,3 +1,16 @@
+2021-03-18 Saam Barati <[email protected]>
+
+ JS->Wasm IC must save the tag registers if it uses them
+ https://bugs.webkit.org/show_bug.cgi?id=223491
+ <rdar://66445108>
+
+ Reviewed by Yusuke Suzuki.
+
+ * wasm/stress/save-tag-callee-saves-in-js-entrypoint-ic.js: Added.
+ (0x0b.WebAssembly.instantiate.wasm.then.e.const.mod.e.instance.exports.Test.prototype.get breakIt):
+ (0x0b.WebAssembly.instantiate.wasm.then.e.const.mod.e.instance.exports.Test):
+ (0x0b.WebAssembly.instantiate.wasm.then.e.const.obj.new.Test):
+
2021-03-17 Ross Kirsling <[email protected]>
[JSC] Error#cause should apply to WebAssembly error constructors too
Added: trunk/JSTests/wasm/stress/save-tag-callee-saves-in-js-entrypoint-ic.js (0 => 274699)
--- trunk/JSTests/wasm/stress/save-tag-callee-saves-in-js-entrypoint-ic.js (rev 0)
+++ trunk/JSTests/wasm/stress/save-tag-callee-saves-in-js-entrypoint-ic.js 2021-03-19 04:20:11 UTC (rev 274699)
@@ -0,0 +1,36 @@
+/*
+(module
+ (type $none_=>_i32 (func (result i32)))
+ (export "test" (func $0))
+ (func $0 (result i32)
+ (i32.const 1234)
+ )
+)
+*/
+
+const wasm = new Uint8Array([
+ 0x00,0x61,0x73,0x6d,0x01,0x00,0x00,0x00,0x01,0x05,0x01,0x60,0x00,0x01,0x7f,0x03,
+ 0x02,0x01,0x00,0x07,0x08,0x01,0x04,0x74,0x65,0x73,0x74,0x00,0x00,0x0a,0x07,0x01,
+ 0x05,0x00,0x41,0xd2,0x09,0x0b
+])
+
+// We should not crash.
+
+WebAssembly.instantiate(wasm).then(e => {
+ const mod = e.instance.exports
+
+ class Test {
+ get breakIt() {
+ return mod.test()
+ }
+ }
+
+ const obj = new Test()
+
+ for (let i = 1; i < 24; i++) {
+ const iterCount = 1 << i
+ for (let j = 0; j < iterCount; j++) {
+ obj.breakIt
+ }
+ }
+});
Modified: trunk/Source/_javascript_Core/ChangeLog (274698 => 274699)
--- trunk/Source/_javascript_Core/ChangeLog 2021-03-19 02:56:02 UTC (rev 274698)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-03-19 04:20:11 UTC (rev 274699)
@@ -1,3 +1,20 @@
+2021-03-18 Saam Barati <[email protected]>
+
+ JS->Wasm IC must save the tag registers if it uses them
+ https://bugs.webkit.org/show_bug.cgi?id=223491
+ <rdar://66445108>
+
+ Reviewed by Yusuke Suzuki.
+
+ It turns out, that when you use a callee save register, you should save it.
+
+ * wasm/js/WebAssemblyFunction.cpp:
+ (JSC::WebAssemblyFunction::usesTagRegisters const):
+ (JSC::WebAssemblyFunction::calleeSaves const):
+ (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
+ (JSC::WebAssemblyFunction::useTagRegisters const): Deleted.
+ * wasm/js/WebAssemblyFunction.h:
+
2021-03-17 Ross Kirsling <[email protected]>
[JSC] Error#cause should apply to WebAssembly error constructors too
Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp (274698 => 274699)
--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp 2021-03-19 02:56:02 UTC (rev 274698)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.cpp 2021-03-19 04:20:11 UTC (rev 274699)
@@ -154,7 +154,7 @@
return rawResult;
}
-bool WebAssemblyFunction::useTagRegisters() const
+bool WebAssemblyFunction::usesTagRegisters() const
{
const auto& signature = Wasm::SignatureInformation::get(signatureIndex());
return signature.argumentCount() || !signature.returnsVoid();
@@ -163,7 +163,13 @@
RegisterSet WebAssemblyFunction::calleeSaves() const
{
// Pessimistically save callee saves in BoundsChecking mode since the LLInt always bounds checks
- return Wasm::PinnedRegisterInfo::get().toSave(Wasm::MemoryMode::BoundsChecking);
+ RegisterSet result = Wasm::PinnedRegisterInfo::get().toSave(Wasm::MemoryMode::BoundsChecking);
+ if (usesTagRegisters()) {
+ RegisterSet tagCalleeSaves = RegisterSet::calleeSaveRegisters();
+ tagCalleeSaves.filter(RegisterSet::runtimeTagRegisters());
+ result.merge(tagCalleeSaves);
+ }
+ return result;
}
RegisterAtOffsetList WebAssemblyFunction::usedCalleeSaveRegisters() const
@@ -250,7 +256,7 @@
slowPath.append(jit.branch32(CCallHelpers::Below,
CCallHelpers::payloadFor(CallFrameSlot::argumentCountIncludingThis), CCallHelpers::TrustedImm32(signature.argumentCount() + 1)));
- if (useTagRegisters())
+ if (usesTagRegisters())
jit.emitMaterializeTagCheckRegisters();
// Loop backwards so we can use the first floating point argument as a scratch.
Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.h (274698 => 274699)
--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.h 2021-03-19 02:56:02 UTC (rev 274698)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyFunction.h 2021-03-19 04:20:11 UTC (rev 274699)
@@ -91,7 +91,7 @@
MacroAssemblerCodePtr<JSEntryPtrTag> jsCallEntrypointSlow();
ptrdiff_t previousInstanceOffset() const;
- bool useTagRegisters() const;
+ bool usesTagRegisters() const;
RegisterSet calleeSaves() const;
