Attachment #219739 for bug #126043

View Details Raw Unified Return to Bug 126043

| Differences between

Lines 28-33 Source/JavaScriptCore/dfg/DFGJITCompiler.cpp_sec1
- Source/JavaScriptCore/dfg/DFGJITCompiler.cpp +3 lines
28		28
29	#if ENABLE(DFG_JIT)	29	#if ENABLE(DFG_JIT)
30		30
		31	#include "ArityCheckFailReturnThunks.h"
31	#include "CodeBlock.h"	32	#include "CodeBlock.h"
32	#include "DFGFailedFinalizer.h"	33	#include "DFGFailedFinalizer.h"
33	#include "DFGInlineCacheWrapperInlines.h"	34	#include "DFGInlineCacheWrapperInlines.h"
Lines 368-373 void JITCompiler::compileFunction() Source/JavaScriptCore/dfg/DFGJITCompiler.cpp_sec2
368	m_speculative->callOperationWithCallFrameRollbackOnException(m_codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck, GPRInfo::regT0);	369	m_speculative->callOperationWithCallFrameRollbackOnException(m_codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck, GPRInfo::regT0);
369	branchTest32(Zero, GPRInfo::regT0).linkTo(fromArityCheck, this);	370	branchTest32(Zero, GPRInfo::regT0).linkTo(fromArityCheck, this);
370	emitStoreCodeOrigin(CodeOrigin(0));	371	emitStoreCodeOrigin(CodeOrigin(0));
		372	move(TrustedImmPtr(m_vm->arityCheckFailReturnThunks->returnPCsFor(*m_vm, m_codeBlock->numParameters())), GPRInfo::regT5);
		373	loadPtr(BaseIndex(GPRInfo::regT5, GPRInfo::regT0, timesPtr()), GPRInfo::regT5);
371	m_callArityFixup = call();	374	m_callArityFixup = call();
372	jump(fromArityCheck);	375	jump(fromArityCheck);
373		376




#if ENABLE(FTL_JIT)

#include "ArityCheckFailReturnThunks.h"
#include "CCallHelpers.h"
#include "CallFrameInlines.h"
#include "CodeBlockWithJITType.h"

void link(State& state)
{
    CodeBlock* codeBlock = state.graph.m_codeBlock;
    VM& vm = state.graph.m_vm;
    
    // LLVM will create its own jump tables as needed.
    codeBlock->clearSwitchJumpTables();

    
    // Create the entrypoint. Note that we use this entrypoint totally differently
    // depending on whether we're doing OSR entry or not.
    CCallHelpers jit(&vm, codeBlock);
    
    OwnPtr<LinkBuffer> linkBuffer;
    CCallHelpers::Label arityCheck;

        jit.store32(
            CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
            CCallHelpers::tagFor(JSStack::ArgumentCount));
        jit.storePtr(GPRInfo::callFrameRegister, &vm.topCallFrame);
        CCallHelpers::Call callArityCheck = jit.call();
#if !ASSERT_DISABLED
        // FIXME: need to make this call register with exception handling somehow. This is
        // part of a bigger problem: FTL should be able to handle exceptions.
        // https://bugs.webkit.org/show_bug.cgi?id=113622
        // Until then, use a JIT ASSERT.
        jit.load64(vm.addressOfException(), GPRInfo::regT1);
        jit.jitAssertIsNull(GPRInfo::regT1);
#endif
        jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
        jit.emitFunctionEpilogue();
        mainPathJumps.append(jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0));
        jit.emitFunctionPrologue();
        jit.move(CCallHelpers::TrustedImmPtr(vm.arityCheckFailReturnThunks->returnPCsFor(vm, codeBlock->numParameters())), GPRInfo::regT5);
        jit.loadPtr(CCallHelpers::BaseIndex(GPRInfo::regT5, GPRInfo::regT0, CCallHelpers::timesPtr()), GPRInfo::regT5);
        CCallHelpers::Call callArityFixup = jit.call();
        jit.emitFunctionEpilogue();
        mainPathJumps.append(jit.jump());

        linkBuffer = adoptPtr(new LinkBuffer(vm, &jit, codeBlock, JITCompilationMustSucceed));
        linkBuffer->link(callArityCheck, codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);
        linkBuffer->link(callArityFixup, FunctionPtr((vm.getCTIStub(arityFixup)).code().executableAddress()));
        linkBuffer->link(mainPathJumps, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));

        state.jitCode->initializeAddressForCall(MacroAssemblerCodePtr(bitwise_cast<void*>(state.generatedFunction)));

        jit.emitFunctionEpilogue();
        CCallHelpers::Jump mainPathJump = jit.jump();
        
        linkBuffer = adoptPtr(new LinkBuffer(vm, &jit, codeBlock, JITCompilationMustSucceed));
            state.graph.m_vm, &jit, codeBlock, JITCompilationMustSucceed));
        linkBuffer->link(mainPathJump, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));

        state.jitCode->initializeAddressForCall(linkBuffer->locationOf(start));

Lines 149-155 struct OSRExit : public DFG::OSRExitBase Source/JavaScriptCore/ftl/FTLOSRExit.h_sec1
- Source/JavaScriptCore/ftl/FTLOSRExit.h -1 lines
149	unsigned numberOfArguments, unsigned numberOfLocals);	149	unsigned numberOfArguments, unsigned numberOfLocals);
150		150
151	MacroAssemblerCodeRef m_code;	151	MacroAssemblerCodeRef m_code;
152	RefPtr<JITStubRoutine> m_registerRestoration;
153		152
154	// The first argument to the exit call may be a value we wish to profile.	153	// The first argument to the exit call may be a value we wish to profile.
155	// If that's the case, the format will be not Invalid and we'll have a	154	// If that's the case, the format will be not Invalid and we'll have a



static void compileStub(
    unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
{
    // Register restoration is a GC-aware JIT stub routine since we need it to stay alive
    // if it's on the stack but all of our other things (like the FTL::OSRExit) are dead.
    exit.m_registerRestoration = createJITStubRoutine(
        generateRegisterRestoration(
            *vm, codeBlock->ownerExecutable(),
            codeBlock->codeType() == FunctionCode ? MustCheckArity : ArityCheckNotRequired),
        *vm, codeBlock->ownerExecutable(), true);
    
    StackMaps::Record* record;
    
    for (unsigned i = jitCode->stackmaps.records.size(); i--;) {

    jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()), GPRInfo::regT0);
    jit.storePtr(GPRInfo::regT0, GPRInfo::regT1);
    jit.storePtr(
        MacroAssembler::TrustedImmPtr(vm->getCTIStub(registerRestorationThunkGenerator).code().executableAddress()),
        MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()));
    
    // Now get state out of the scratch buffer and place it back into the stack. This part does



/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "ArityCheckFailReturnThunks.h"

#if ENABLE(JIT)

#include "AssemblyHelpers.h"
#include "LinkBuffer.h"
#include "StackAlignment.h"

namespace JSC {

ArityCheckFailReturnThunks::ArityCheckFailReturnThunks()
    : m_nextSize(0)
{
}

ArityCheckFailReturnThunks::~ArityCheckFailReturnThunks() { }

CodeLocationLabel* ArityCheckFailReturnThunks::returnPCsFor(
    VM& vm, unsigned numExpectedArgumentsIncludingThis)
{
    ASSERT(numExpectedArgumentsIncludingThis >= 1);
    
    numExpectedArgumentsIncludingThis = WTF::roundUpToMultipleOf(
        stackAlignmentRegisters(), numExpectedArgumentsIncludingThis);
    
    {
        ConcurrentJITLocker locker(m_lock);
        if (numExpectedArgumentsIncludingThis < m_nextSize)
            return m_returnPCArrays.last().get();
    }
    
    ASSERT(!isCompilationThread());
    
    numExpectedArgumentsIncludingThis = std::max(
        numExpectedArgumentsIncludingThis,
        m_nextSize * 2);
    
    AssemblyHelpers jit(&vm, 0);
    
    Vector<AssemblyHelpers::Label> labels;
    
    for (unsigned size = m_nextSize; size <= numExpectedArgumentsIncludingThis; size += stackAlignmentRegisters()) {
        labels.append(jit.label());
        
        jit.nearCall();
        jit.pop(GPRInfo::regT2);
        jit.load32(
            AssemblyHelpers::Address(
                AssemblyHelpers::stackPointerRegister,
                (JSStack::ArgumentCount - JSStack::CallerFrameAndPCSize) * sizeof(Register) +
                PayloadOffset),
            GPRInfo::regT1);
        jit.add32(
            AssemblyHelpers::TrustedImm32(
                JSStack::CallFrameHeaderSize - JSStack::CallerFrameAndPCSize + size - 1),
            GPRInfo::regT1);
        jit.lshift32(AssemblyHelpers::TrustedImm32(3), GPRInfo::regT1);
        jit.addPtr(AssemblyHelpers::stackPointerRegister, GPRInfo::regT1);
        jit.loadPtr(GPRInfo::regT1, GPRInfo::regT1);
        
        jit.addPtr(
            AssemblyHelpers::TrustedImm32(size * sizeof(Register)),
            AssemblyHelpers::stackPointerRegister);
        
        jit.jump(GPRInfo::regT1);
    }
    
    LinkBuffer linkBuffer(vm, &jit, GLOBAL_THUNK_ID);
    
    std::unique_ptr<CodeLocationLabel[]> returnPCs =
        std::make_unique<CodeLocationLabel[]>(labels.size());
    for (unsigned size = 0; size <= numExpectedArgumentsIncludingThis; size += stackAlignmentRegisters()) {
        unsigned index = size / stackAlignmentRegisters();
        if (size < m_nextSize)
            returnPCs[index] = m_returnPCArrays.last()[index];
        else
            returnPCs[index] = linkBuffer.locationOf(labels[(size - m_nextSize) / stackAlignmentRegisters()]);
    }

    CodeLocationLabel* result = returnPCs.get();

    {
        ConcurrentJITLocker locker(m_lock);
        m_returnPCArrays.append(std::move(returnPCs));
        m_refs.append(FINALIZE_CODE(linkBuffer, ("Arity check fail return thunks for up to numArgs = %u", numExpectedArgumentsIncludingThis)));
        m_nextSize = numExpectedArgumentsIncludingThis + stackAlignmentRegisters();
    }
    
    return result;
}

} // namespace JSC

#endif // ENABLE(JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef ArityCheckFailReturnThunks_h
#define ArityCheckFailReturnThunks_h

#if ENABLE(JIT)

#include "CodeLocation.h"
#include "ConcurrentJITLock.h"
#include <wtf/HashMap.h>

namespace JSC {

class ArityCheckFailReturnThunks {
public:
    ArityCheckFailReturnThunks();
    ~ArityCheckFailReturnThunks();
    
    // Returns a pointer to an array of return labels indexed by missingArgs.
    CodeLocationLabel* returnPCsFor(VM&, unsigned numExpectedArgumentsIncludingThis);
    
private:
    Vector<std::unique_ptr<CodeLocationLabel[]>> m_returnPCArrays;
    unsigned m_nextSize;
    Vector<MacroAssemblerCodeRef> m_refs;
    ConcurrentJITLock m_lock;
};

} // namespace JSC

#endif // ENABLE(JIT)

#endif // ArityCheckFailReturnThunks_h


Lines 34-39 Source/JavaScriptCore/jit/JIT.cpp_sec1
- Source/JavaScriptCore/jit/JIT.cpp +3 lines
34	JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;	34	JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
35	#endif	35	#endif
36		36
		37	#include "ArityCheckFailReturnThunks.h"
37	#include "CodeBlock.h"	38	#include "CodeBlock.h"
38	#include "DFGCapabilities.h"	39	#include "DFGCapabilities.h"
39	#include "Interpreter.h"	40	#include "Interpreter.h"
Lines 576-581 CompilationResult JIT::privateCompile(JI Source/JavaScriptCore/jit/JIT.cpp_sec2
576	if (returnValueGPR != regT0)	577	if (returnValueGPR != regT0)
577	move(returnValueGPR, regT0);	578	move(returnValueGPR, regT0);
578	branchTest32(Zero, regT0).linkTo(beginLabel, this);	579	branchTest32(Zero, regT0).linkTo(beginLabel, this);
		580	move(TrustedImmPtr(m_vm->arityCheckFailReturnThunks->returnPCsFor(*m_vm, m_codeBlock->numParameters())), regT5);
		581	loadPtr(BaseIndex(regT5, regT0, timesPtr()), regT5);
579	emitNakedCall(m_vm->getCTIStub(arityFixup).code());	582	emitNakedCall(m_vm->getCTIStub(arityFixup).code());
580		583
581	#if !ASSERT_DISABLED	584	#if !ASSERT_DISABLED



        case MustPreserveRegisters: {
            RegisterPreservationWrappers* wrappers = ensureWrappers();
            if (!wrappers->withoutArityCheck)
                wrappers->withoutArityCheck = generateRegisterPreservationWrapper(vm, executable, m_ref.code());
            return wrappers->withoutArityCheck.code();
        } }
    case MustCheckArity:

        case MustPreserveRegisters: {
            RegisterPreservationWrappers* wrappers = ensureWrappers();
            if (!wrappers->withArityCheck)
                wrappers->withArityCheck = generateRegisterPreservationWrapper(vm, executable, m_withArityCheck);
            return wrappers->withArityCheck.code();
        } }
    }



    return sizeof(Register) * numberOfNewStackSlots;
}

MacroAssemblerCodeRef generateRegisterPreservationWrapper(VM& vm, ExecutableBase* executable, MacroAssemblerCodePtr target)
{
#if ENABLE(FTL_JIT)
    // We shouldn't ever be generating wrappers for native functions.

    
    AssemblyHelpers::Call call = jit.nearCall();
    
    generateRegisterRestoration(jit);
    
    LinkBuffer linkBuffer(vm, &jit, GLOBAL_THUNK_ID);
    linkBuffer.link(call, CodeLocationLabel(target));

#endif // ENABLE(FTL_JIT)
}

void generateRegisterRestoration(AssemblyHelpers& jit)
{
    RegisterSet toSave = registersToPreserve();
    ptrdiff_t offset = registerPreservationOffset();

            (JSStack::ArgumentCount - JSStack::CallerFrameAndPCSize) * sizeof(Register) + PayloadOffset),
        GPRInfo::regT2);
    
    if (arity == MustCheckArity) {
        // It's possible that the arity checker had extended the stack. In that case, we need
        // to adjust the argument count to be the max of what the frame claims and what the
        // executable desired.
        FunctionExecutable* functionExecutable = jsCast<FunctionExecutable*>(executable);
        int parameterCount = functionExecutable->parameterCount() + 1;
        AssemblyHelpers::Jump ok = jit.branch32(
            AssemblyHelpers::AboveOrEqual, GPRInfo::regT2,
            AssemblyHelpers::TrustedImm32(parameterCount));
        jit.move(AssemblyHelpers::TrustedImm32(parameterCount), GPRInfo::regT2);
        ok.link(&jit);
    }
    
    jit.lshift32(AssemblyHelpers::TrustedImm32(3), GPRInfo::regT2);
    
    jit.addPtr(AssemblyHelpers::TrustedImm32(offset), AssemblyHelpers::stackPointerRegister);

    jit.jump(GPRInfo::regT1);
}

MacroAssemblerCodeRef registerRestorationThunkGenerator(VM* vm)
    VM& vm, ExecutableBase* executable, ArityCheckMode arity)
{
    AssemblyHelpers jit(vm, 0);
    generateRegisterRestoration(jit);
    LinkBuffer linkBuffer(*vm, &jit, GLOBAL_THUNK_ID);
    return FINALIZE_CODE(linkBuffer, ("Register restoration thunk"));
    return FINALIZE_DFG_CODE(linkBuffer, ("Register restoration thunk for %s/%s", toCString(scriptExecutable->hashFor(CodeForCall)).data(), toCString(scriptExecutable->hashFor(CodeForConstruct)).data()));
}

} // namespace JSC




ptrdiff_t registerPreservationOffset();

MacroAssemblerCodeRef generateRegisterPreservationWrapper(VM&, ExecutableBase*, MacroAssemblerCodePtr target);

void generateRegisterRestoration(AssemblyHelpers&);

MacroAssemblerCodeRef registerRestorationThunkGenerator(VM*);

} // namespace JSC




{
    JSInterfaceJIT jit(vm);

    // We enter with fixup count, in aligned stack units, in regT0 and the return thunk in
    // regT5. We use VM::currentReturnThunkPC instead of regT5 on X86-32.
#if USE(JSVALUE64)
#  if CPU(X86_64)
    jit.pop(JSInterfaceJIT::regT4);
#  endif
    jit.lshift32(JSInterfaceJIT::TrustedImm32(logStackAlignmentRegisters()), JSInterfaceJIT::regT0);
    jit.neg64(JSInterfaceJIT::regT0);
    jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
    jit.load32(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, JSStack::ArgumentCount * sizeof(Register)), JSInterfaceJIT::regT2);
    jit.add32(JSInterfaceJIT::TrustedImm32(JSStack::CallFrameHeaderSize), JSInterfaceJIT::regT2);

    // Move current frame down regT0 number of slots

    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
    jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(copyLoop, &jit);

    // Fill in regT0 - 1 missing arg slots with undefined
    jit.move(JSInterfaceJIT::regT0, JSInterfaceJIT::regT2);
    jit.move(JSInterfaceJIT::TrustedImm64(ValueUndefined), JSInterfaceJIT::regT1);
    jit.add32(JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2);
    JSInterfaceJIT::Label fillUndefinedLoop(jit.label());
    jit.store64(JSInterfaceJIT::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight));
    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
    jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(fillUndefinedLoop, &jit);
    
    // Adjust call frame register and stack pointer to account for missing args
    jit.move(JSInterfaceJIT::regT0, JSInterfaceJIT::regT1);
    jit.lshift64(JSInterfaceJIT::TrustedImm32(3), JSInterfaceJIT::regT1);
    jit.addPtr(JSInterfaceJIT::regT1, JSInterfaceJIT::callFrameRegister);
    jit.addPtr(JSInterfaceJIT::regT1, JSInterfaceJIT::stackPointerRegister);

    // Save the original return PC.
    jit.loadPtr(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, CallFrame::returnPCOffset()), GPRInfo::regT1);
    jit.storePtr(GPRInfo::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight));
    
    // Install the new return PC.
    jit.storePtr(GPRInfo::regT5, JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, CallFrame::returnPCOffset()));

#  if CPU(X86_64)
    jit.push(JSInterfaceJIT::regT4);



    
    ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());
    int missingArgumentCount = newCodeBlock->numParameters() - argumentCountIncludingThis;
    int neededStackSpace = missingArgumentCount + 1; // Allow space to save the original return PC.
    int paddedStackSpace = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), neededStackSpace);

#if ENABLE(LLINT_CLOOP)
    if (!stack->grow(exec->registers() - passedStackSpace))
        return -1;
#else
    UNUSED_PARAM(stack);
    if (!exec->vm().isSafeToRecurse(paddedStackSpace * sizeof(Register)))
        return -1;
#endif // ENABLE(LLINT_CLOOP)

    return paddedStackSpace / stackAlignmentRegisters();
}

inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)

Lines 27-32 Source/JavaScriptCore/runtime/StackAlignment.h_sec1
- Source/JavaScriptCore/runtime/StackAlignment.h +6 lines
27	#define StackAlignment_h	27	#define StackAlignment_h
28		28
29	#include "JSCJSValue.h"	29	#include "JSCJSValue.h"
		30	#include <wtf/MathExtras.h>
30		31
31	namespace JSC {	32	namespace JSC {
32		33
Lines 38-43 inline unsigned stackAlignmentRegisters( Source/JavaScriptCore/runtime/StackAlignment.h_sec2
38	return stackAlignmentBytes() / sizeof(EncodedJSValue);	39	return stackAlignmentBytes() / sizeof(EncodedJSValue);
39	}	40	}
40		41
		42	inline unsigned logStackAlignmentRegisters()
		43	{
		44	return WTF::fastLog2(stackAlignmentRegisters());
		45	}
		46
41	} // namespace JSC	47	} // namespace JSC
42		48
43	#endif // StackAlignment_h	49	#endif // StackAlignment_h



#include "VM.h"

#include "ArgList.h"
#include "ArityCheckFailReturnThunks.h"
#include "ArrayBufferNeuteringWatchpoint.h"
#include "CallFrameInlines.h"
#include "CodeBlock.h"


#if ENABLE(JIT)
    jitStubs = adoptPtr(new JITThunks());
    arityCheckFailReturnThunks = std::make_unique<ArityCheckFailReturnThunks>();
#endif

#if ENABLE(FTL_JIT)

Lines 64-69 Source/JavaScriptCore/runtime/VM.h_sec1
- Source/JavaScriptCore/runtime/VM.h -1 / +7 lines
64		64
65	namespace JSC {	65	namespace JSC {
66		66
		67	class ArityCheckFailReturnThunks;
67	class CodeBlock;	68	class CodeBlock;
68	class CodeCache;	69	class CodeCache;
69	class CommonIdentifiers;	70	class CommonIdentifiers;
Lines 332-338 namespace JSC { Source/JavaScriptCore/runtime/VM.h_sec2
332	return jitStubs->ctiStub(this, generator);	333	return jitStubs->ctiStub(this, generator);
333	}	334	}
334	NativeExecutable* getHostFunction(NativeFunction, Intrinsic);	335	NativeExecutable* getHostFunction(NativeFunction, Intrinsic);
335	#endif	336
		337	std::unique_ptr<ArityCheckFailReturnThunks> arityCheckFailReturnThunks;
		338	#if CPU(X86)
		339	void* currentReturnThunkPC;
		340	#endif // CPU(X86)
		341	#endif // ENABLE(JIT)
336	#if ENABLE(FTL_JIT)	342	#if ENABLE(FTL_JIT)
337	std::unique_ptr<FTL::Thunks> ftlThunks;	343	std::unique_ptr<FTL::Thunks> ftlThunks;
338	#endif	344	#endif

Return to Bug 126043

Lines 440-453 MacroAssemblerCodeRef arityFixup(VM* vm) Source/JavaScriptCore/jit/ThunkGenerators.cpp_sec1
- Source/JavaScriptCore/jit/ThunkGenerators.cpp -7 / +18 lines
440	{	440	{
441	JSInterfaceJIT jit(vm);	441	JSInterfaceJIT jit(vm);
442		442
443	// We enter with fixup count in regT0	443	// We enter with fixup count, in aligned stack units, in regT0 and the return thunk in
		444	// regT5. We use VM::currentReturnThunkPC instead of regT5 on X86-32.
444	#if USE(JSVALUE64)	445	#if USE(JSVALUE64)
445	# if CPU(X86_64)	446	# if CPU(X86_64)
446	jit.pop(JSInterfaceJIT::regT4);	447	jit.pop(JSInterfaceJIT::regT4);
447	# endif	448	# endif
		449	jit.lshift32(JSInterfaceJIT::TrustedImm32(logStackAlignmentRegisters()), JSInterfaceJIT::regT0);
448	jit.neg64(JSInterfaceJIT::regT0);	450	jit.neg64(JSInterfaceJIT::regT0);
449	jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);	451	jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
450	jit.load32(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, JSStack::ArgumentCount * 8), JSInterfaceJIT::regT2);	452	jit.load32(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, JSStack::ArgumentCount * sizeof(Register)), JSInterfaceJIT::regT2);
451	jit.add32(JSInterfaceJIT::TrustedImm32(JSStack::CallFrameHeaderSize), JSInterfaceJIT::regT2);	453	jit.add32(JSInterfaceJIT::TrustedImm32(JSStack::CallFrameHeaderSize), JSInterfaceJIT::regT2);
452		454
453	// Move current frame down regT0 number of slots	455	// Move current frame down regT0 number of slots
Lines 457-474 MacroAssemblerCodeRef arityFixup(VM* vm) Source/JavaScriptCore/jit/ThunkGenerators.cpp_sec2
457	jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);	459	jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
458	jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(copyLoop, &jit);	460	jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(copyLoop, &jit);
459		461
460	// Fill in regT0 missing arg slots with undefined	462	// Fill in regT0 - 1 missing arg slots with undefined
461	jit.move(JSInterfaceJIT::regT0, JSInterfaceJIT::regT2);	463	jit.move(JSInterfaceJIT::regT0, JSInterfaceJIT::regT2);
462	jit.move(JSInterfaceJIT::TrustedImm64(ValueUndefined), JSInterfaceJIT::regT1);	464	jit.move(JSInterfaceJIT::TrustedImm64(ValueUndefined), JSInterfaceJIT::regT1);
		465	jit.add32(JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2);
463	JSInterfaceJIT::Label fillUndefinedLoop(jit.label());	466	JSInterfaceJIT::Label fillUndefinedLoop(jit.label());
464	jit.store64(JSInterfaceJIT::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight));	467	jit.store64(JSInterfaceJIT::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight));
465	jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);	468	jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
466	jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(fillUndefinedLoop, &jit);	469	jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(fillUndefinedLoop, &jit);
467		470
468	// Adjust call frame register and stack pointer to account for missing args	471	// Adjust call frame register and stack pointer to account for missing args
469	jit.lshift64(JSInterfaceJIT::TrustedImm32(3), JSInterfaceJIT::regT0);	472	jit.move(JSInterfaceJIT::regT0, JSInterfaceJIT::regT1);
470	jit.addPtr(JSInterfaceJIT::regT0, JSInterfaceJIT::callFrameRegister);	473	jit.lshift64(JSInterfaceJIT::TrustedImm32(3), JSInterfaceJIT::regT1);
471	jit.addPtr(JSInterfaceJIT::regT0, JSInterfaceJIT::stackPointerRegister);	474	jit.addPtr(JSInterfaceJIT::regT1, JSInterfaceJIT::callFrameRegister);
		475	jit.addPtr(JSInterfaceJIT::regT1, JSInterfaceJIT::stackPointerRegister);
		476
		477	// Save the original return PC.
		478	jit.loadPtr(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, CallFrame::returnPCOffset()), GPRInfo::regT1);
		479	jit.storePtr(GPRInfo::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight));
		480
		481	// Install the new return PC.
		482	jit.storePtr(GPRInfo::regT5, JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, CallFrame::returnPCOffset()));
472		483
473	# if CPU(X86_64)	484	# if CPU(X86_64)
474	jit.push(JSInterfaceJIT::regT4);	485	jit.push(JSInterfaceJIT::regT4);

Lines 277-282 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec1
- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj +8 lines
277	0F6B1CC41862C47800845D97 /* FTLRegisterAtOffset.h in Headers / = {isa = PBXBuildFile; fileRef = 0F6B1CC01862C47800845D97 / FTLRegisterAtOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };	277	0F6B1CC41862C47800845D97 /* FTLRegisterAtOffset.h in Headers / = {isa = PBXBuildFile; fileRef = 0F6B1CC01862C47800845D97 / FTLRegisterAtOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
278	0F6B1CC51862C47800845D97 /* FTLUnwindInfo.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F6B1CC11862C47800845D97 / FTLUnwindInfo.cpp */; };	278	0F6B1CC51862C47800845D97 /* FTLUnwindInfo.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F6B1CC11862C47800845D97 / FTLUnwindInfo.cpp */; };
279	0F6B1CC61862C47800845D97 /* FTLUnwindInfo.h in Headers / = {isa = PBXBuildFile; fileRef = 0F6B1CC21862C47800845D97 / FTLUnwindInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };	279	0F6B1CC61862C47800845D97 /* FTLUnwindInfo.h in Headers / = {isa = PBXBuildFile; fileRef = 0F6B1CC21862C47800845D97 / FTLUnwindInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
		280	0F6B1CC918641DF800845D97 /* ArityCheckFailReturnThunks.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F6B1CC718641DF800845D97 / ArityCheckFailReturnThunks.cpp */; };
		281	0F6B1CCA18641DF800845D97 /* ArityCheckFailReturnThunks.h in Headers / = {isa = PBXBuildFile; fileRef = 0F6B1CC818641DF800845D97 / ArityCheckFailReturnThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
280	0F7025A91714B0FA00382C0E /* DFGOSRExitCompilerCommon.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F7025A71714B0F800382C0E / DFGOSRExitCompilerCommon.cpp */; };	282	0F7025A91714B0FA00382C0E /* DFGOSRExitCompilerCommon.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F7025A71714B0F800382C0E / DFGOSRExitCompilerCommon.cpp */; };
281	0F7025AA1714B0FC00382C0E /* DFGOSRExitCompilerCommon.h in Headers / = {isa = PBXBuildFile; fileRef = 0F7025A81714B0F800382C0E / DFGOSRExitCompilerCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };	283	0F7025AA1714B0FC00382C0E /* DFGOSRExitCompilerCommon.h in Headers / = {isa = PBXBuildFile; fileRef = 0F7025A81714B0F800382C0E / DFGOSRExitCompilerCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
282	0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F714CA116EA92ED00F3EBEB / DFGBackwardsPropagationPhase.cpp */; };	284	0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F714CA116EA92ED00F3EBEB / DFGBackwardsPropagationPhase.cpp */; };
Lines 1599-1604 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec2
1599	0F6B1CC01862C47800845D97 /* FTLRegisterAtOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLRegisterAtOffset.h; path = ftl/FTLRegisterAtOffset.h; sourceTree = "<group>"; };	1601	0F6B1CC01862C47800845D97 /* FTLRegisterAtOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLRegisterAtOffset.h; path = ftl/FTLRegisterAtOffset.h; sourceTree = "<group>"; };
1600	0F6B1CC11862C47800845D97 /* FTLUnwindInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLUnwindInfo.cpp; path = ftl/FTLUnwindInfo.cpp; sourceTree = "<group>"; };	1602	0F6B1CC11862C47800845D97 /* FTLUnwindInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLUnwindInfo.cpp; path = ftl/FTLUnwindInfo.cpp; sourceTree = "<group>"; };
1601	0F6B1CC21862C47800845D97 /* FTLUnwindInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLUnwindInfo.h; path = ftl/FTLUnwindInfo.h; sourceTree = "<group>"; };	1603	0F6B1CC21862C47800845D97 /* FTLUnwindInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLUnwindInfo.h; path = ftl/FTLUnwindInfo.h; sourceTree = "<group>"; };
		1604	0F6B1CC718641DF800845D97 /* ArityCheckFailReturnThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArityCheckFailReturnThunks.cpp; sourceTree = "<group>"; };
		1605	0F6B1CC818641DF800845D97 /* ArityCheckFailReturnThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArityCheckFailReturnThunks.h; sourceTree = "<group>"; };
1602	0F7025A71714B0F800382C0E /* DFGOSRExitCompilerCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompilerCommon.cpp; path = dfg/DFGOSRExitCompilerCommon.cpp; sourceTree = "<group>"; };	1606	0F7025A71714B0F800382C0E /* DFGOSRExitCompilerCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompilerCommon.cpp; path = dfg/DFGOSRExitCompilerCommon.cpp; sourceTree = "<group>"; };
1603	0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitCompilerCommon.h; path = dfg/DFGOSRExitCompilerCommon.h; sourceTree = "<group>"; };	1607	0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitCompilerCommon.h; path = dfg/DFGOSRExitCompilerCommon.h; sourceTree = "<group>"; };
1604	0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBackwardsPropagationPhase.cpp; path = dfg/DFGBackwardsPropagationPhase.cpp; sourceTree = "<group>"; };	1608	0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBackwardsPropagationPhase.cpp; path = dfg/DFGBackwardsPropagationPhase.cpp; sourceTree = "<group>"; };
Lines 3005-3010 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec3
3005	1429D92C0ED22D7000B89619 /* jit */ = {	3009	1429D92C0ED22D7000B89619 /* jit */ = {
3006	isa = PBXGroup;	3010	isa = PBXGroup;
3007	children = (	3011	children = (
		3012	0F6B1CC718641DF800845D97 /* ArityCheckFailReturnThunks.cpp */,
		3013	0F6B1CC818641DF800845D97 /* ArityCheckFailReturnThunks.h */,
3008	0F24E53B17EA9F5900ABB217 /* AssemblyHelpers.cpp */,	3014	0F24E53B17EA9F5900ABB217 /* AssemblyHelpers.cpp */,
3009	0F24E53C17EA9F5900ABB217 /* AssemblyHelpers.h */,	3015	0F24E53C17EA9F5900ABB217 /* AssemblyHelpers.h */,
3010	0F24E53D17EA9F5900ABB217 /* CCallHelpers.h */,	3016	0F24E53D17EA9F5900ABB217 /* CCallHelpers.h */,
Lines 4979-4984 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec4
4979	9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */,	4985	9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */,
4980	451539B912DC994500EF7AC4 /* Yarr.h in Headers */,	4986	451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
4981	0F666ECD1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h in Headers */,	4987	0F666ECD1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h in Headers */,
		4988	0F6B1CCA18641DF800845D97 /* ArityCheckFailReturnThunks.h in Headers */,
4982	86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */,	4989	86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */,
4983	86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */,	4990	86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */,
4984	86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */,	4991	86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */,
Lines 5805-5810 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec5
5805	0F8F2B9E17306C8D007DBDA5 /* SourceCode.cpp in Sources */,	5812	0F8F2B9E17306C8D007DBDA5 /* SourceCode.cpp in Sources */,
5806	0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */,	5813	0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */,
5807	E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,	5814	E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
		5815	0F6B1CC918641DF800845D97 /* ArityCheckFailReturnThunks.cpp in Sources */,
5808	0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */,	5816	0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */,
5809	0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */,	5817	0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */,
5810	0FD82E86141F3FF100179C94 /* SpeculatedType.cpp in Sources */,	5818	0FD82E86141F3FF100179C94 /* SpeculatedType.cpp in Sources */,

Lines 28-33 Source/JavaScriptCore/ftl/FTLLink.cpp_sec1
- Source/JavaScriptCore/ftl/FTLLink.cpp -7 / +10 lines
28		28
29	#if ENABLE(FTL_JIT)	29	#if ENABLE(FTL_JIT)
30		30
		31	#include "ArityCheckFailReturnThunks.h"
31	#include "CCallHelpers.h"	32	#include "CCallHelpers.h"
32	#include "CallFrameInlines.h"	33	#include "CallFrameInlines.h"
33	#include "CodeBlockWithJITType.h"	34	#include "CodeBlockWithJITType.h"
Lines 46-51 using namespace DFG; Source/JavaScriptCore/ftl/FTLLink.cpp_sec2
46	void link(State& state)	47	void link(State& state)
47	{	48	{
48	CodeBlock* codeBlock = state.graph.m_codeBlock;	49	CodeBlock* codeBlock = state.graph.m_codeBlock;
		50	VM& vm = state.graph.m_vm;
49		51
50	// LLVM will create its own jump tables as needed.	52	// LLVM will create its own jump tables as needed.
51	codeBlock->clearSwitchJumpTables();	53	codeBlock->clearSwitchJumpTables();
Lines 61-67 void link(State& state) Source/JavaScriptCore/ftl/FTLLink.cpp_sec3
61		63
62	// Create the entrypoint. Note that we use this entrypoint totally differently	64	// Create the entrypoint. Note that we use this entrypoint totally differently
63	// depending on whether we're doing OSR entry or not.	65	// depending on whether we're doing OSR entry or not.
64	CCallHelpers jit(&state.graph.m_vm, codeBlock);	66	CCallHelpers jit(&vm, codeBlock);
65		67
66	OwnPtr<LinkBuffer> linkBuffer;	68	OwnPtr<LinkBuffer> linkBuffer;
67	CCallHelpers::Label arityCheck;	69	CCallHelpers::Label arityCheck;
Lines 84-110 void link(State& state) Source/JavaScriptCore/ftl/FTLLink.cpp_sec4
84	jit.store32(	86	jit.store32(
85	CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),	87	CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
86	CCallHelpers::tagFor(JSStack::ArgumentCount));	88	CCallHelpers::tagFor(JSStack::ArgumentCount));
87	jit.storePtr(GPRInfo::callFrameRegister, &state.graph.m_vm.topCallFrame);	89	jit.storePtr(GPRInfo::callFrameRegister, &vm.topCallFrame);
88	CCallHelpers::Call callArityCheck = jit.call();	90	CCallHelpers::Call callArityCheck = jit.call();
89	#if !ASSERT_DISABLED	91	#if !ASSERT_DISABLED
90	// FIXME: need to make this call register with exception handling somehow. This is	92	// FIXME: need to make this call register with exception handling somehow. This is
91	// part of a bigger problem: FTL should be able to handle exceptions.	93	// part of a bigger problem: FTL should be able to handle exceptions.
92	// https://bugs.webkit.org/show_bug.cgi?id=113622	94	// https://bugs.webkit.org/show_bug.cgi?id=113622
93	// Until then, use a JIT ASSERT.	95	// Until then, use a JIT ASSERT.
94	jit.load64(state.graph.m_vm.addressOfException(), GPRInfo::regT1);	96	jit.load64(vm.addressOfException(), GPRInfo::regT1);
95	jit.jitAssertIsNull(GPRInfo::regT1);	97	jit.jitAssertIsNull(GPRInfo::regT1);
96	#endif	98	#endif
97	jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);	99	jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
98	jit.emitFunctionEpilogue();	100	jit.emitFunctionEpilogue();
99	mainPathJumps.append(jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0));	101	mainPathJumps.append(jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0));
100	jit.emitFunctionPrologue();	102	jit.emitFunctionPrologue();
		103	jit.move(CCallHelpers::TrustedImmPtr(vm.arityCheckFailReturnThunks->returnPCsFor(vm, codeBlock->numParameters())), GPRInfo::regT5);
		104	jit.loadPtr(CCallHelpers::BaseIndex(GPRInfo::regT5, GPRInfo::regT0, CCallHelpers::timesPtr()), GPRInfo::regT5);
101	CCallHelpers::Call callArityFixup = jit.call();	105	CCallHelpers::Call callArityFixup = jit.call();
102	jit.emitFunctionEpilogue();	106	jit.emitFunctionEpilogue();
103	mainPathJumps.append(jit.jump());	107	mainPathJumps.append(jit.jump());
104		108
105	linkBuffer = adoptPtr(new LinkBuffer(state.graph.m_vm, &jit, codeBlock, JITCompilationMustSucceed));	109	linkBuffer = adoptPtr(new LinkBuffer(vm, &jit, codeBlock, JITCompilationMustSucceed));
106	linkBuffer->link(callArityCheck, codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);	110	linkBuffer->link(callArityCheck, codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);
107	linkBuffer->link(callArityFixup, FunctionPtr((state.graph.m_vm.getCTIStub(arityFixup)).code().executableAddress()));	111	linkBuffer->link(callArityFixup, FunctionPtr((vm.getCTIStub(arityFixup)).code().executableAddress()));
108	linkBuffer->link(mainPathJumps, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));	112	linkBuffer->link(mainPathJumps, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
109		113
110	state.jitCode->initializeAddressForCall(MacroAssemblerCodePtr(bitwise_cast<void*>(state.generatedFunction)));	114	state.jitCode->initializeAddressForCall(MacroAssemblerCodePtr(bitwise_cast<void*>(state.generatedFunction)));
Lines 120-127 void link(State& state) Source/JavaScriptCore/ftl/FTLLink.cpp_sec5
120	jit.emitFunctionEpilogue();	124	jit.emitFunctionEpilogue();
121	CCallHelpers::Jump mainPathJump = jit.jump();	125	CCallHelpers::Jump mainPathJump = jit.jump();
122		126
123	linkBuffer = adoptPtr(new LinkBuffer(	127	linkBuffer = adoptPtr(new LinkBuffer(vm, &jit, codeBlock, JITCompilationMustSucceed));
124	state.graph.m_vm, &jit, codeBlock, JITCompilationMustSucceed));
125	linkBuffer->link(mainPathJump, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));	128	linkBuffer->link(mainPathJump, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
126		129
127	state.jitCode->initializeAddressForCall(linkBuffer->locationOf(start));	130	state.jitCode->initializeAddressForCall(linkBuffer->locationOf(start));

Lines 46-59 using namespace DFG; Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec1
- Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp -9 / +1 lines
46	static void compileStub(	46	static void compileStub(
47	unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)	47	unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
48	{	48	{
49	// Register restoration is a GC-aware JIT stub routine since we need it to stay alive
50	// if it's on the stack but all of our other things (like the FTL::OSRExit) are dead.
51	exit.m_registerRestoration = createJITStubRoutine(
52	generateRegisterRestoration(
53	*vm, codeBlock->ownerExecutable(),
54	codeBlock->codeType() == FunctionCode ? MustCheckArity : ArityCheckNotRequired),
55	*vm, codeBlock->ownerExecutable(), true);
56
57	StackMaps::Record* record;	49	StackMaps::Record* record;
58		50
59	for (unsigned i = jitCode->stackmaps.records.size(); i--;) {	51	for (unsigned i = jitCode->stackmaps.records.size(); i--;) {
Lines 219-225 static void compileStub( Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec2
219	jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()), GPRInfo::regT0);	211	jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()), GPRInfo::regT0);
220	jit.storePtr(GPRInfo::regT0, GPRInfo::regT1);	212	jit.storePtr(GPRInfo::regT0, GPRInfo::regT1);
221	jit.storePtr(	213	jit.storePtr(
222	MacroAssembler::TrustedImmPtr(exit.m_registerRestoration->code().code().executableAddress()),	214	MacroAssembler::TrustedImmPtr(vm->getCTIStub(registerRestorationThunkGenerator).code().executableAddress()),
223	MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()));	215	MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()));
224		216
225	// Now get state out of the scratch buffer and place it back into the stack. This part does	217	// Now get state out of the scratch buffer and place it back into the stack. This part does

Line 0 Source/JavaScriptCore/jit/ArityCheckFailReturnThunks.cpp_sec1
- Source/JavaScriptCore/jit/ArityCheckFailReturnThunks.cpp +121 lines
		1	/*
		2	* Copyright (C) 2013 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "ArityCheckFailReturnThunks.h"
		28
		29	#if ENABLE(JIT)
		30
		31	#include "AssemblyHelpers.h"
		32	#include "LinkBuffer.h"
		33	#include "StackAlignment.h"
		34
		35	namespace JSC {
		36
		37	ArityCheckFailReturnThunks::ArityCheckFailReturnThunks()
		38	: m_nextSize(0)
		39	{
		40	}
		41
		42	ArityCheckFailReturnThunks::~ArityCheckFailReturnThunks() { }
		43
		44	CodeLocationLabel* ArityCheckFailReturnThunks::returnPCsFor(
		45	VM& vm, unsigned numExpectedArgumentsIncludingThis)
		46	{
		47	ASSERT(numExpectedArgumentsIncludingThis >= 1);
		48
		49	numExpectedArgumentsIncludingThis = WTF::roundUpToMultipleOf(
		50	stackAlignmentRegisters(), numExpectedArgumentsIncludingThis);
		51
		52	{
		53	ConcurrentJITLocker locker(m_lock);
		54	if (numExpectedArgumentsIncludingThis < m_nextSize)
		55	return m_returnPCArrays.last().get();
		56	}
		57
		58	ASSERT(!isCompilationThread());
		59
		60	numExpectedArgumentsIncludingThis = std::max(
		61	numExpectedArgumentsIncludingThis,
		62	m_nextSize * 2);
		63
		64	AssemblyHelpers jit(&vm, 0);
65
66	Vector<AssemblyHelpers::Label> labels;
67
68	for (unsigned size = m_nextSize; size <= numExpectedArgumentsIncludingThis; size += stackAlignmentRegisters()) {
69	labels.append(jit.label());
70
71	jit.nearCall();
72	jit.pop(GPRInfo::regT2);
73	jit.load32(
74	AssemblyHelpers::Address(
75	AssemblyHelpers::stackPointerRegister,
76	(JSStack::ArgumentCount - JSStack::CallerFrameAndPCSize) * sizeof(Register) +
77	PayloadOffset),
78	GPRInfo::regT1);
79	jit.add32(
80	AssemblyHelpers::TrustedImm32(
81	JSStack::CallFrameHeaderSize - JSStack::CallerFrameAndPCSize + size - 1),
82	GPRInfo::regT1);
83	jit.lshift32(AssemblyHelpers::TrustedImm32(3), GPRInfo::regT1);
84	jit.addPtr(AssemblyHelpers::stackPointerRegister, GPRInfo::regT1);
85	jit.loadPtr(GPRInfo::regT1, GPRInfo::regT1);
86
87	jit.addPtr(
88	AssemblyHelpers::TrustedImm32(size * sizeof(Register)),
89	AssemblyHelpers::stackPointerRegister);
90
91	jit.jump(GPRInfo::regT1);
92	}
93
94	LinkBuffer linkBuffer(vm, &jit, GLOBAL_THUNK_ID);
95
96	std::unique_ptr<CodeLocationLabel[]> returnPCs =
97	std::make_unique<CodeLocationLabel[]>(labels.size());
98	for (unsigned size = 0; size <= numExpectedArgumentsIncludingThis; size += stackAlignmentRegisters()) {
99	unsigned index = size / stackAlignmentRegisters();
100	if (size < m_nextSize)
101	returnPCs[index] = m_returnPCArrays.last()[index];
102	else
103	returnPCs[index] = linkBuffer.locationOf(labels[(size - m_nextSize) / stackAlignmentRegisters()]);
104	}
105
106	CodeLocationLabel* result = returnPCs.get();
107
108	{
109	ConcurrentJITLocker locker(m_lock);
110	m_returnPCArrays.append(std::move(returnPCs));
111	m_refs.append(FINALIZE_CODE(linkBuffer, ("Arity check fail return thunks for up to numArgs = %u", numExpectedArgumentsIncludingThis)));
112	m_nextSize = numExpectedArgumentsIncludingThis + stackAlignmentRegisters();
113	}
114
115	return result;
116	}
117
118	} // namespace JSC
119
120	#endif // ENABLE(JIT)
121

Lines 168-174 JITCode::CodePtr DirectJITCode::addressF Source/JavaScriptCore/jit/JITCode.cpp_sec1
- Source/JavaScriptCore/jit/JITCode.cpp -2 / +2 lines
168	case MustPreserveRegisters: {	168	case MustPreserveRegisters: {
169	RegisterPreservationWrappers* wrappers = ensureWrappers();	169	RegisterPreservationWrappers* wrappers = ensureWrappers();
170	if (!wrappers->withoutArityCheck)	170	if (!wrappers->withoutArityCheck)
171	wrappers->withoutArityCheck = generateRegisterPreservationWrapper(vm, executable, m_ref.code(), ArityCheckNotRequired);	171	wrappers->withoutArityCheck = generateRegisterPreservationWrapper(vm, executable, m_ref.code());
172	return wrappers->withoutArityCheck.code();	172	return wrappers->withoutArityCheck.code();
173	} }	173	} }
174	case MustCheckArity:	174	case MustCheckArity:
Lines 179-185 JITCode::CodePtr DirectJITCode::addressF Source/JavaScriptCore/jit/JITCode.cpp_sec2
179	case MustPreserveRegisters: {	179	case MustPreserveRegisters: {
180	RegisterPreservationWrappers* wrappers = ensureWrappers();	180	RegisterPreservationWrappers* wrappers = ensureWrappers();
181	if (!wrappers->withArityCheck)	181	if (!wrappers->withArityCheck)
182	wrappers->withArityCheck = generateRegisterPreservationWrapper(vm, executable, m_withArityCheck, MustCheckArity);	182	wrappers->withArityCheck = generateRegisterPreservationWrapper(vm, executable, m_withArityCheck);
183	return wrappers->withArityCheck.code();	183	return wrappers->withArityCheck.code();
184	} }	184	} }
185	}	185	}

Lines 58-64 ptrdiff_t registerPreservationOffset() Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.cpp_sec1
- Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.cpp -23 / +8 lines
58	return sizeof(Register) * numberOfNewStackSlots;	58	return sizeof(Register) * numberOfNewStackSlots;
59	}	59	}
60		60
61	MacroAssemblerCodeRef generateRegisterPreservationWrapper(VM& vm, ExecutableBase* executable, MacroAssemblerCodePtr target, ArityCheckMode arity)	61	MacroAssemblerCodeRef generateRegisterPreservationWrapper(VM& vm, ExecutableBase* executable, MacroAssemblerCodePtr target)
62	{	62	{
63	#if ENABLE(FTL_JIT)	63	#if ENABLE(FTL_JIT)
64	// We shouldn't ever be generating wrappers for native functions.	64	// We shouldn't ever be generating wrappers for native functions.
Lines 114-120 MacroAssemblerCodeRef generateRegisterPr Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.cpp_sec2
114		114
115	AssemblyHelpers::Call call = jit.nearCall();	115	AssemblyHelpers::Call call = jit.nearCall();
116		116
117	generateRegisterRestoration(jit, executable, arity);	117	generateRegisterRestoration(jit);
118		118
119	LinkBuffer linkBuffer(vm, &jit, GLOBAL_THUNK_ID);	119	LinkBuffer linkBuffer(vm, &jit, GLOBAL_THUNK_ID);
120	linkBuffer.link(call, CodeLocationLabel(target));	120	linkBuffer.link(call, CodeLocationLabel(target));
Lines 130-136 MacroAssemblerCodeRef generateRegisterPr Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.cpp_sec3
130	#endif // ENABLE(FTL_JIT)	130	#endif // ENABLE(FTL_JIT)
131	}	131	}
132		132
133	void generateRegisterRestoration(AssemblyHelpers& jit, ExecutableBase* executable, ArityCheckMode arity)	133	void generateRegisterRestoration(AssemblyHelpers& jit)
134	{	134	{
135	RegisterSet toSave = registersToPreserve();	135	RegisterSet toSave = registersToPreserve();
136	ptrdiff_t offset = registerPreservationOffset();	136	ptrdiff_t offset = registerPreservationOffset();
Lines 145-163 void generateRegisterRestoration(Assembl Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.cpp_sec4
145	(JSStack::ArgumentCount - JSStack::CallerFrameAndPCSize) * sizeof(Register) + PayloadOffset),	145	(JSStack::ArgumentCount - JSStack::CallerFrameAndPCSize) * sizeof(Register) + PayloadOffset),
146	GPRInfo::regT2);	146	GPRInfo::regT2);
147		147
148	if (arity == MustCheckArity) {
149	// It's possible that the arity checker had extended the stack. In that case, we need
150	// to adjust the argument count to be the max of what the frame claims and what the
151	// executable desired.
152	FunctionExecutable* functionExecutable = jsCast<FunctionExecutable*>(executable);
153	int parameterCount = functionExecutable->parameterCount() + 1;
154	AssemblyHelpers::Jump ok = jit.branch32(
155	AssemblyHelpers::AboveOrEqual, GPRInfo::regT2,
156	AssemblyHelpers::TrustedImm32(parameterCount));
157	jit.move(AssemblyHelpers::TrustedImm32(parameterCount), GPRInfo::regT2);
158	ok.link(&jit);
159	}
160
161	jit.lshift32(AssemblyHelpers::TrustedImm32(3), GPRInfo::regT2);	148	jit.lshift32(AssemblyHelpers::TrustedImm32(3), GPRInfo::regT2);
162		149
163	jit.addPtr(AssemblyHelpers::TrustedImm32(offset), AssemblyHelpers::stackPointerRegister);	150	jit.addPtr(AssemblyHelpers::TrustedImm32(offset), AssemblyHelpers::stackPointerRegister);
Lines 199-212 void generateRegisterRestoration(Assembl Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.cpp_sec5
199	jit.jump(GPRInfo::regT1);	186	jit.jump(GPRInfo::regT1);
200	}	187	}
201		188
202	MacroAssemblerCodeRef generateRegisterRestoration(	189	MacroAssemblerCodeRef registerRestorationThunkGenerator(VM* vm)
203	VM& vm, ExecutableBase* executable, ArityCheckMode arity)
204	{	190	{
205	ScriptExecutable* scriptExecutable = jsCast<ScriptExecutable*>(executable);	191	AssemblyHelpers jit(vm, 0);
206	AssemblyHelpers jit(&vm, 0);	192	generateRegisterRestoration(jit);
207	generateRegisterRestoration(jit, executable, arity);	193	LinkBuffer linkBuffer(*vm, &jit, GLOBAL_THUNK_ID);
208	LinkBuffer linkBuffer(vm, &jit, GLOBAL_THUNK_ID);	194	return FINALIZE_CODE(linkBuffer, ("Register restoration thunk"));
209	return FINALIZE_DFG_CODE(linkBuffer, ("Register restoration thunk for %s/%s", toCString(scriptExecutable->hashFor(CodeForCall)).data(), toCString(scriptExecutable->hashFor(CodeForConstruct)).data()));
210	}	195	}
211		196
212	} // namespace JSC	197	} // namespace JSC

Lines 39-49 RegisterSet registersToPreserve(); Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.h_sec1
- Source/JavaScriptCore/jit/RegisterPreservationWrapperGenerator.h -3 / +3 lines
39		39
40	ptrdiff_t registerPreservationOffset();	40	ptrdiff_t registerPreservationOffset();
41		41
42	MacroAssemblerCodeRef generateRegisterPreservationWrapper(VM&, ExecutableBase*, MacroAssemblerCodePtr target, ArityCheckMode);	42	MacroAssemblerCodeRef generateRegisterPreservationWrapper(VM&, ExecutableBase*, MacroAssemblerCodePtr target);
43		43
44	void generateRegisterRestoration(AssemblyHelpers&, ExecutableBase*, ArityCheckMode);	44	void generateRegisterRestoration(AssemblyHelpers&);
45		45
46	MacroAssemblerCodeRef generateRegisterRestoration(VM&, ExecutableBase*, ArityCheckMode);	46	MacroAssemblerCodeRef registerRestorationThunkGenerator(VM*);
47		47
48	} // namespace JSC	48	} // namespace JSC
49		49

Lines 58-75 ALWAYS_INLINE int arityCheckFor(ExecStat Source/JavaScriptCore/runtime/CommonSlowPaths.h_sec1
- Source/JavaScriptCore/runtime/CommonSlowPaths.h -4 / +5 lines
58		58
59	ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());	59	ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());
60	int missingArgumentCount = newCodeBlock->numParameters() - argumentCountIncludingThis;	60	int missingArgumentCount = newCodeBlock->numParameters() - argumentCountIncludingThis;
61	int paddedMissingArgumentCount = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), missingArgumentCount);	61	int neededStackSpace = missingArgumentCount + 1; // Allow space to save the original return PC.
		62	int paddedStackSpace = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), neededStackSpace);
62		63
63	#if ENABLE(LLINT_CLOOP)	64	#if ENABLE(LLINT_CLOOP)
64	if (!stack->grow(exec->registers() - paddedMissingArgumentCount))	65	if (!stack->grow(exec->registers() - passedStackSpace))
65	return -1;	66	return -1;
66	#else	67	#else
67	UNUSED_PARAM(stack);	68	UNUSED_PARAM(stack);
68	if (!exec->vm().isSafeToRecurse(paddedMissingArgumentCount * sizeof(Register)))	69	if (!exec->vm().isSafeToRecurse(paddedStackSpace * sizeof(Register)))
69	return -1;	70	return -1;
70	#endif // ENABLE(LLINT_CLOOP)	71	#endif // ENABLE(LLINT_CLOOP)
71		72
72	return paddedMissingArgumentCount;	73	return paddedStackSpace / stackAlignmentRegisters();
73	}	74	}
74		75
75	inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)	76	inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)

Lines 30-35 Source/JavaScriptCore/runtime/VM.cpp_sec1
- Source/JavaScriptCore/runtime/VM.cpp +2 lines
30	#include "VM.h"	30	#include "VM.h"
31		31
32	#include "ArgList.h"	32	#include "ArgList.h"
		33	#include "ArityCheckFailReturnThunks.h"
33	#include "ArrayBufferNeuteringWatchpoint.h"	34	#include "ArrayBufferNeuteringWatchpoint.h"
34	#include "CallFrameInlines.h"	35	#include "CallFrameInlines.h"
35	#include "CodeBlock.h"	36	#include "CodeBlock.h"
Lines 266-271 VM::VM(VMType vmType, HeapType heapType) Source/JavaScriptCore/runtime/VM.cpp_sec2
266		267
267	#if ENABLE(JIT)	268	#if ENABLE(JIT)
268	jitStubs = adoptPtr(new JITThunks());	269	jitStubs = adoptPtr(new JITThunks());
		270	arityCheckFailReturnThunks = std::make_unique<ArityCheckFailReturnThunks>();
269	#endif	271	#endif
270		272
271	#if ENABLE(FTL_JIT)	273	#if ENABLE(FTL_JIT)