Attachment #225804 for bug #129429

View Details Raw Unified Return to Bug 129429

| Differences between



2014-03-04  peavo@outlook.com  <peavo@outlook.com>

        [Win32][LLINT] Crash when running JSC stress tests.
        https://bugs.webkit.org/show_bug.cgi?id=129429

        On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
        where the guard page is a barrier between committed and uncommitted memory.
        When data from the guard page is read or written, the guard page is moved, and memory is committed.
        This is how the system grows the stack.
        When using the C stack on Windows we need to precommit the needed stack space.
        Otherwise we might crash later if we access uncommitted stack memory.
        This can happen if we allocate stack space larger than the page guard size (4K).
        The system does not get the chance to move the guard page, and commit more memory,
        and we crash if uncommitted memory is accessed.
        The MSVC compiler fixes this by inserting a call to the _chkstk() function,
        when needed, see http://support.microsoft.com/kb/100775.

        Reviewed by NOBODY (OOPS!).

        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
        * jit/Repatch.cpp:
        (JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
        * offlineasm/x86.rb: Compile fix, and small simplification.
        * runtime/VM.cpp:
        (JSC::preCommitStackMemory): Added function to precommit stack memory.
        (JSC::VM::updateStackLimit): Call function to precommit stack memory when stack limit is updated.

2014-03-04  Andreas Kling  <akling@apple.com>

        Micro-optimize Strings in JS bindings.

Lines 29-32 printf "END" > LowLevelInterpreterWin.as Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh_sec1
- Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh -1 / +1 lines
29		29
30	# When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.	30	# When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.
31		31
32	/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LLIntAssembly.h" \|\| exit 1	32	/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LowLevelInterpreterWin.asm" \|\| exit 1



    ASSERT(owner != scratch1);
    ASSERT(owner != scratch2);

#if ENABLE(DFG_JIT)
    MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
#endif
    MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
#if ENABLE(DFG_JIT)
    definitelyNotMarked.link(&jit);
#endif
    return call;
}
#endif // ENABLE(GGC)



    end
    
    def x86Operand(kind)
        if !isIntelSyntax
            x86AddressOperand(:ptr)
        else
            "#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"

                }
            end
            op = operands[0].x86CallOperand(:ptr)
            if isMSVC && (operands[0].is_a? LabelReference)
                writeSymbolToFile(op)
            end
            $asm.puts "call #{op}"



    return oldReservedZoneSize;
}

#if PLATFORM(WIN)
// On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
// where the guard page is a barrier between committed and uncommitted memory.
// When data from the guard page is read or written, the guard page is moved, and memory is committed.
// This is how the system grows the stack.
// When using the C stack on Windows we need to precommit the needed stack space.
// Otherwise we might crash later if we access uncommitted stack memory.
// This can happen if we allocate stack space larger than the page guard size (4K).
// The system does not get the chance to move the guard page, and commit more memory,
// and we crash if uncommitted memory is accessed.
// The MSVC compiler fixes this by inserting a call to the _chkstk() function,
// when needed, see http://support.microsoft.com/kb/100775.

static void preCommitStackMemory(void* stackLimit)
{
    MEMORY_BASIC_INFORMATION uncommittedMemory;
    if (VirtualQuery(stackLimit, &uncommittedMemory, sizeof(uncommittedMemory)) > 0)
        if (uncommittedMemory.State == MEM_RESERVE) {
            int size = uncommittedMemory.RegionSize;
            OSAllocator::commit(stackLimit, size, true, false);
        }
}
#endif

inline void VM::updateStackLimit()
{
#if PLATFORM(WIN)
    void* lastStackLimit = m_stackLimit;
#endif

    if (m_stackPointerAtVMEntry) {
        ASSERT(wtfThreadData().stack().isGrowingDownward());
        char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);

#endif
    }

#if PLATFORM(WIN)
    if (lastStackLimit != m_stackLimit)
        preCommitStackMemory(m_stackLimit);
#endif
}

#if ENABLE(FTL_JIT)



2014-03-04  peavo@outlook.com  <peavo@outlook.com>

        [Win32][LLINT] Crash when running JSC stress tests.
        https://bugs.webkit.org/show_bug.cgi?id=129429

        Reviewed by NOBODY (OOPS!).

        * wtf/Platform.h: Enable LLINT on Win32.
        * wtf/StackBounds.cpp: Avoid many asserts in StackBounds::initialize(), since stack memory is precommitted.

2014-03-02  Jaehun Lim  <ljaehun.lim@samsung.com>

        [EFL] Remove m_initEfl from RunLoop.



#if !defined(ENABLE_JIT) \
    && (CPU(X86) || CPU(X86_64) || CPU(ARM) || CPU(ARM64) || CPU(MIPS)) \
    && !OS(WINCE) \
    && !(OS(WINDOWS) && CPU(X86_64))
#define ENABLE_JIT 1
#endif


   low-level interpreter. */
#if !defined(ENABLE_LLINT) \
    && ENABLE(JIT) \
    && (OS(DARWIN) || OS(LINUX) || OS(FREEBSD) || OS(WINDOWS)) \
    && ((OS(DARWIN) && !PLATFORM(EFL)) || PLATFORM(GTK) || PLATFORM(WIN)) \
    && (CPU(X86) || CPU(X86_64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(ARM64) || CPU(MIPS) || CPU(SH4))
#define ENABLE_LLINT 1
#endif

#endif

/* Configure the interpreter */
#if COMPILER(GCC) || COMPILER(MSVC)
#define HAVE_COMPUTED_GOTO 1
#endif


Lines 151-157 void StackBounds::initialize() Source/WTF/wtf/StackBounds.cpp_sec1
- Source/WTF/wtf/StackBounds.cpp -1 lines
151		151
152	MEMORY_BASIC_INFORMATION uncommittedMemory;	152	MEMORY_BASIC_INFORMATION uncommittedMemory;
153	VirtualQuery(stackOrigin.AllocationBase, &uncommittedMemory, sizeof(uncommittedMemory));	153	VirtualQuery(stackOrigin.AllocationBase, &uncommittedMemory, sizeof(uncommittedMemory));
154	ASSERT(uncommittedMemory.State == MEM_RESERVE);
155		154
156	MEMORY_BASIC_INFORMATION guardPage;	155	MEMORY_BASIC_INFORMATION guardPage;
157	VirtualQuery(static_cast<char*>(uncommittedMemory.BaseAddress) + uncommittedMemory.RegionSize, &guardPage, sizeof(guardPage));	156	VirtualQuery(static_cast<char*>(uncommittedMemory.BaseAddress) + uncommittedMemory.RegionSize, &guardPage, sizeof(guardPage));

Return to Bug 129429

Lines 824-832 static MacroAssembler::Call writeBarrier Source/JavaScriptCore/jit/Repatch.cpp_sec1
- Source/JavaScriptCore/jit/Repatch.cpp +4 lines
824	ASSERT(owner != scratch1);	824	ASSERT(owner != scratch1);
825	ASSERT(owner != scratch2);	825	ASSERT(owner != scratch2);
826		826
		827	#if ENABLE(DFG_JIT)
827	MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);	828	MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
		829	#endif
828	MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);	830	MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
		831	#if ENABLE(DFG_JIT)
829	definitelyNotMarked.link(&jit);	832	definitelyNotMarked.link(&jit);
		833	#endif
830	return call;	834	return call;
831	}	835	}
832	#endif // ENABLE(GGC)	836	#endif // ENABLE(GGC)

Lines 414-420 class BaseIndex Source/JavaScriptCore/offlineasm/x86.rb_sec1
- Source/JavaScriptCore/offlineasm/x86.rb -2 / +2 lines
414	end	414	end
415		415
416	def x86Operand(kind)	416	def x86Operand(kind)
417	if !isIntelSyntax \|\| kind != :double	417	if !isIntelSyntax
418	x86AddressOperand(:ptr)	418	x86AddressOperand(:ptr)
419	else	419	else
420	"#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"	420	"#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"
Lines 1326-1332 class Instruction Source/JavaScriptCore/offlineasm/x86.rb_sec2
1326	}	1326	}
1327	end	1327	end
1328	op = operands[0].x86CallOperand(:ptr)	1328	op = operands[0].x86CallOperand(:ptr)
1329	if isMSVC && (/\Allint_/.match(op) \|\| /\Aslow_path/.match(op))	1329	if isMSVC && (operands[0].is_a? LabelReference)
1330	writeSymbolToFile(op)	1330	writeSymbolToFile(op)
1331	end	1331	end
1332	$asm.puts "call #{op}"	1332	$asm.puts "call #{op}"

Lines 749-756 size_t VM::updateReservedZoneSize(size_t Source/JavaScriptCore/runtime/VM.cpp_sec1
- Source/JavaScriptCore/runtime/VM.cpp +32 lines
749	return oldReservedZoneSize;	749	return oldReservedZoneSize;
750	}	750	}
751		751
		752	#if PLATFORM(WIN)
		753	// On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
		754	// where the guard page is a barrier between committed and uncommitted memory.
		755	// When data from the guard page is read or written, the guard page is moved, and memory is committed.
		756	// This is how the system grows the stack.
		757	// When using the C stack on Windows we need to precommit the needed stack space.
		758	// Otherwise we might crash later if we access uncommitted stack memory.
		759	// This can happen if we allocate stack space larger than the page guard size (4K).
		760	// The system does not get the chance to move the guard page, and commit more memory,
		761	// and we crash if uncommitted memory is accessed.
		762	// The MSVC compiler fixes this by inserting a call to the _chkstk() function,
		763	// when needed, see http://support.microsoft.com/kb/100775.
		764
		765	static void preCommitStackMemory(void* stackLimit)
		766	{
		767	MEMORY_BASIC_INFORMATION uncommittedMemory;
		768	if (VirtualQuery(stackLimit, &uncommittedMemory, sizeof(uncommittedMemory)) > 0)
		769	if (uncommittedMemory.State == MEM_RESERVE) {
		770	int size = uncommittedMemory.RegionSize;
		771	OSAllocator::commit(stackLimit, size, true, false);
		772	}
		773	}
		774	#endif
		775
752	inline void VM::updateStackLimit()	776	inline void VM::updateStackLimit()
753	{	777	{
		778	#if PLATFORM(WIN)
		779	void* lastStackLimit = m_stackLimit;
		780	#endif
		781
754	if (m_stackPointerAtVMEntry) {	782	if (m_stackPointerAtVMEntry) {
755	ASSERT(wtfThreadData().stack().isGrowingDownward());	783	ASSERT(wtfThreadData().stack().isGrowingDownward());
756	char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);	784	char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
Lines 769-774 inline void VM::updateStackLimit() Source/JavaScriptCore/runtime/VM.cpp_sec2
769	#endif	797	#endif
770	}	798	}
771		799
		800	#if PLATFORM(WIN)
		801	if (lastStackLimit != m_stackLimit)
		802	preCommitStackMemory(m_stackLimit);
		803	#endif
772	}	804	}
773		805
774	#if ENABLE(FTL_JIT)	806	#if ENABLE(FTL_JIT)

Lines 640-646 Source/WTF/wtf/Platform.h_sec1
- Source/WTF/wtf/Platform.h -4 / +4 lines
640	#if !defined(ENABLE_JIT) \	640	#if !defined(ENABLE_JIT) \
641	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM) \|\| CPU(ARM64) \|\| CPU(MIPS)) \	641	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM) \|\| CPU(ARM64) \|\| CPU(MIPS)) \
642	&& !OS(WINCE) \	642	&& !OS(WINCE) \
643	&& !OS(WINDOWS)	643	&& !(OS(WINDOWS) && CPU(X86_64))
644	#define ENABLE_JIT 1	644	#define ENABLE_JIT 1
645	#endif	645	#endif
646		646
Lines 693-700 Source/WTF/wtf/Platform.h_sec2
693	low-level interpreter. */	693	low-level interpreter. */
694	#if !defined(ENABLE_LLINT) \	694	#if !defined(ENABLE_LLINT) \
695	&& ENABLE(JIT) \	695	&& ENABLE(JIT) \
696	&& (OS(DARWIN) \|\| OS(LINUX) \|\| OS(FREEBSD)) \	696	&& (OS(DARWIN) \|\| OS(LINUX) \|\| OS(FREEBSD) \|\| OS(WINDOWS)) \
697	&& ((OS(DARWIN) && !PLATFORM(EFL)) \|\| PLATFORM(GTK)) \	697	&& ((OS(DARWIN) && !PLATFORM(EFL)) \|\| PLATFORM(GTK) \|\| PLATFORM(WIN)) \
698	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM_THUMB2) \|\| CPU(ARM_TRADITIONAL) \|\| CPU(ARM64) \|\| CPU(MIPS) \|\| CPU(SH4))	698	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM_THUMB2) \|\| CPU(ARM_TRADITIONAL) \|\| CPU(ARM64) \|\| CPU(MIPS) \|\| CPU(SH4))
699	#define ENABLE_LLINT 1	699	#define ENABLE_LLINT 1
700	#endif	700	#endif
Lines 783-789 Source/WTF/wtf/Platform.h_sec3
783	#endif	783	#endif
784		784
785	/* Configure the interpreter */	785	/* Configure the interpreter */
786	#if COMPILER(GCC)	786	#if COMPILER(GCC) \|\| COMPILER(MSVC)
787	#define HAVE_COMPUTED_GOTO 1	787	#define HAVE_COMPUTED_GOTO 1
788	#endif	788	#endif
789		789

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +27 lines
		1	2014-03-04 peavo@outlook.com <peavo@outlook.com>
		2
		3	[Win32][LLINT] Crash when running JSC stress tests.
		4	https://bugs.webkit.org/show_bug.cgi?id=129429
		5
		6	On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
		7	where the guard page is a barrier between committed and uncommitted memory.
		8	When data from the guard page is read or written, the guard page is moved, and memory is committed.
		9	This is how the system grows the stack.
		10	When using the C stack on Windows we need to precommit the needed stack space.
		11	Otherwise we might crash later if we access uncommitted stack memory.
		12	This can happen if we allocate stack space larger than the page guard size (4K).
		13	The system does not get the chance to move the guard page, and commit more memory,
		14	and we crash if uncommitted memory is accessed.
		15	The MSVC compiler fixes this by inserting a call to the _chkstk() function,
		16	when needed, see http://support.microsoft.com/kb/100775.
		17
		18	Reviewed by NOBODY (OOPS!).
		19
		20	* JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
		21	* jit/Repatch.cpp:
		22	(JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
		23	* offlineasm/x86.rb: Compile fix, and small simplification.
		24	* runtime/VM.cpp:
		25	(JSC::preCommitStackMemory): Added function to precommit stack memory.
		26	(JSC::VM::updateStackLimit): Call function to precommit stack memory when stack limit is updated.
		27
1	2014-03-04 Andreas Kling <akling@apple.com>	28	2014-03-04 Andreas Kling <akling@apple.com>
2		29
3	Micro-optimize Strings in JS bindings.	30	Micro-optimize Strings in JS bindings.

Lines 1-3 Source/WTF/ChangeLog_sec1
- Source/WTF/ChangeLog +10 lines
		1	2014-03-04 peavo@outlook.com <peavo@outlook.com>
		2
		3	[Win32][LLINT] Crash when running JSC stress tests.
		4	https://bugs.webkit.org/show_bug.cgi?id=129429
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* wtf/Platform.h: Enable LLINT on Win32.
		9	* wtf/StackBounds.cpp: Avoid many asserts in StackBounds::initialize(), since stack memory is precommitted.
		10
1	2014-03-02 Jaehun Lim <ljaehun.lim@samsung.com>	11	2014-03-02 Jaehun Lim <ljaehun.lim@samsung.com>
2		12
3	[EFL] Remove m_initEfl from RunLoop.	13	[EFL] Remove m_initEfl from RunLoop.