Attachment #225818 for bug #129429

View Details Raw Unified Return to Bug 129429

| Differences between



2014-03-04  peavo@outlook.com  <peavo@outlook.com>

        [Win32][LLINT] Crash when running JSC stress tests.
        https://bugs.webkit.org/show_bug.cgi?id=129429

        On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
        where the guard page is a barrier between committed and uncommitted memory.
        When data from the guard page is read or written, the guard page is moved, and memory is committed.
        This is how the system grows the stack.
        When using the C stack on Windows we need to precommit the needed stack space.
        Otherwise we might crash later if we access uncommitted stack memory.
        This can happen if we allocate stack space larger than the page guard size (4K).
        The system does not get the chance to move the guard page, and commit more memory,
        and we crash if uncommitted memory is accessed.
        The MSVC compiler fixes this by inserting a call to the _chkstk() function,
        when needed, see http://support.microsoft.com/kb/100775.

        Reviewed by NOBODY (OOPS!).

        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
        * jit/Repatch.cpp:
        (JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
        * offlineasm/x86.rb: Compile fix, and small simplification.
        * runtime/VM.cpp:
        (JSC::preCommitStackMemory): Added function to precommit stack memory.
        (JSC::VM::updateStackLimit): Call function to precommit stack memory when stack limit is updated.

2014-03-04  Andreas Kling  <akling@apple.com>

        Micro-optimize Strings in JS bindings.

Lines 29-32 printf "END" > LowLevelInterpreterWin.as Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh_sec1
- Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh -1 / +1 lines
29		29
30	# When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.	30	# When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.
31		31
32	/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LLIntAssembly.h" \|\| exit 1	32	/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LowLevelInterpreterWin.asm" \|\| exit 1



    ASSERT(owner != scratch1);
    ASSERT(owner != scratch2);

#if ENABLE(DFG_JIT)
    MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
#endif
    MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
#if ENABLE(DFG_JIT)
    definitelyNotMarked.link(&jit);
#endif
    return call;
}
#endif // ENABLE(GGC)



    end
    
    def x86Operand(kind)
        if !isIntelSyntax
            x86AddressOperand(:ptr)
        else
            "#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"

                }
            end
            op = operands[0].x86CallOperand(:ptr)
            if isMSVC && (operands[0].is_a? LabelReference)
                writeSymbolToFile(op)
            end
            $asm.puts "call #{op}"



    return oldReservedZoneSize;
}

#if PLATFORM(WIN)
// On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
// where the guard page is a barrier between committed and uncommitted memory.
// When data from the guard page is read or written, the guard page is moved, and memory is committed.
// This is how the system grows the stack.
// When using the C stack on Windows we need to precommit the needed stack space.
// Otherwise we might crash later if we access uncommitted stack memory.
// This can happen if we allocate stack space larger than the page guard size (4K).
// The system does not get the chance to move the guard page, and commit more memory,
// and we crash if uncommitted memory is accessed.
// The MSVC compiler fixes this by inserting a call to the _chkstk() function,
// when needed, see http://support.microsoft.com/kb/100775.

static void preCommitStackMemory(void* stackLimit)
{
    MEMORY_BASIC_INFORMATION uncommittedMemory;
    if (VirtualQuery(stackLimit, &uncommittedMemory, sizeof(uncommittedMemory)) > 0)
        if (uncommittedMemory.State == MEM_RESERVE) {
            int size = uncommittedMemory.RegionSize;
            // Commit memory
            OSAllocator::commit(stackLimit, size, true, false);

            // Move guard page
            MEMORY_BASIC_INFORMATION guardPage;
            char* guardPagePointer = reinterpret_cast<char*>(stackLimit) + size;
            if (VirtualQuery(guardPagePointer, &guardPage, sizeof(guardPage)) > 0) {
                ASSERT(guardPage.Protect & PAGE_GUARD);
                DWORD oldProtect;
                // Remove guard flag from old guard page
                BOOL retval = VirtualProtect(guardPagePointer, guardPage.RegionSize, PAGE_READWRITE, &oldProtect);
                ASSERT(retval);
                char* newGuardPagePointer = reinterpret_cast<char*>(stackLimit) - guardPage.RegionSize;
                // Commit new guard page
                OSAllocator::commit(newGuardPagePointer, guardPage.RegionSize, true, false);
                // Set guard flag on new guard page
                retval = VirtualProtect(newGuardPagePointer, guardPage.RegionSize, PAGE_READWRITE | PAGE_GUARD, &oldProtect);
                ASSERT(retval);
            }
        }
}
#endif

inline void VM::updateStackLimit()
{
#if PLATFORM(WIN)
    void* lastStackLimit = m_stackLimit;
#endif

    if (m_stackPointerAtVMEntry) {
        ASSERT(wtfThreadData().stack().isGrowingDownward());
        char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);

#endif
    }

#if PLATFORM(WIN)
    if (lastStackLimit != m_stackLimit)
        preCommitStackMemory(m_stackLimit);
#endif
}

#if ENABLE(FTL_JIT)



2014-03-04  peavo@outlook.com  <peavo@outlook.com>

        [Win32][LLINT] Crash when running JSC stress tests.
        https://bugs.webkit.org/show_bug.cgi?id=129429

        Reviewed by NOBODY (OOPS!).

        * wtf/Platform.h: Enable LLINT on Win32.

2014-03-02  Jaehun Lim  <ljaehun.lim@samsung.com>

        [EFL] Remove m_initEfl from RunLoop.



#if !defined(ENABLE_JIT) \
    && (CPU(X86) || CPU(X86_64) || CPU(ARM) || CPU(ARM64) || CPU(MIPS)) \
    && !OS(WINCE) \
    && !(OS(WINDOWS) && CPU(X86_64))
#define ENABLE_JIT 1
#endif


   low-level interpreter. */
#if !defined(ENABLE_LLINT) \
    && ENABLE(JIT) \
    && (OS(DARWIN) || OS(LINUX) || OS(FREEBSD) || OS(WINDOWS)) \
    && ((OS(DARWIN) && !PLATFORM(EFL)) || PLATFORM(GTK) || PLATFORM(WIN)) \
    && (CPU(X86) || CPU(X86_64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(ARM64) || CPU(MIPS) || CPU(SH4))
#define ENABLE_LLINT 1
#endif

#endif

/* Configure the interpreter */
#if COMPILER(GCC) || COMPILER(MSVC)
#define HAVE_COMPUTED_GOTO 1
#endif


Return to Bug 129429

Lines 824-832 static MacroAssembler::Call writeBarrier Source/JavaScriptCore/jit/Repatch.cpp_sec1
- Source/JavaScriptCore/jit/Repatch.cpp +4 lines
824	ASSERT(owner != scratch1);	824	ASSERT(owner != scratch1);
825	ASSERT(owner != scratch2);	825	ASSERT(owner != scratch2);
826		826
		827	#if ENABLE(DFG_JIT)
827	MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);	828	MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
		829	#endif
828	MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);	830	MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
		831	#if ENABLE(DFG_JIT)
829	definitelyNotMarked.link(&jit);	832	definitelyNotMarked.link(&jit);
		833	#endif
830	return call;	834	return call;
831	}	835	}
832	#endif // ENABLE(GGC)	836	#endif // ENABLE(GGC)

Lines 414-420 class BaseIndex Source/JavaScriptCore/offlineasm/x86.rb_sec1
- Source/JavaScriptCore/offlineasm/x86.rb -2 / +2 lines
414	end	414	end
415		415
416	def x86Operand(kind)	416	def x86Operand(kind)
417	if !isIntelSyntax \|\| kind != :double	417	if !isIntelSyntax
418	x86AddressOperand(:ptr)	418	x86AddressOperand(:ptr)
419	else	419	else
420	"#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"	420	"#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"
Lines 1326-1332 class Instruction Source/JavaScriptCore/offlineasm/x86.rb_sec2
1326	}	1326	}
1327	end	1327	end
1328	op = operands[0].x86CallOperand(:ptr)	1328	op = operands[0].x86CallOperand(:ptr)
1329	if isMSVC && (/\Allint_/.match(op) \|\| /\Aslow_path/.match(op))	1329	if isMSVC && (operands[0].is_a? LabelReference)
1330	writeSymbolToFile(op)	1330	writeSymbolToFile(op)
1331	end	1331	end
1332	$asm.puts "call #{op}"	1332	$asm.puts "call #{op}"

Lines 749-756 size_t VM::updateReservedZoneSize(size_t Source/JavaScriptCore/runtime/VM.cpp_sec1
- Source/JavaScriptCore/runtime/VM.cpp +50 lines
749	return oldReservedZoneSize;	749	return oldReservedZoneSize;
750	}	750	}
751		751
		752	#if PLATFORM(WIN)
		753	// On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
		754	// where the guard page is a barrier between committed and uncommitted memory.
		755	// When data from the guard page is read or written, the guard page is moved, and memory is committed.
		756	// This is how the system grows the stack.
		757	// When using the C stack on Windows we need to precommit the needed stack space.
		758	// Otherwise we might crash later if we access uncommitted stack memory.
		759	// This can happen if we allocate stack space larger than the page guard size (4K).
		760	// The system does not get the chance to move the guard page, and commit more memory,
		761	// and we crash if uncommitted memory is accessed.
		762	// The MSVC compiler fixes this by inserting a call to the _chkstk() function,
		763	// when needed, see http://support.microsoft.com/kb/100775.
		764
		765	static void preCommitStackMemory(void* stackLimit)
		766	{
		767	MEMORY_BASIC_INFORMATION uncommittedMemory;
		768	if (VirtualQuery(stackLimit, &uncommittedMemory, sizeof(uncommittedMemory)) > 0)
		769	if (uncommittedMemory.State == MEM_RESERVE) {
		770	int size = uncommittedMemory.RegionSize;
		771	// Commit memory
		772	OSAllocator::commit(stackLimit, size, true, false);
		773
		774	// Move guard page
		775	MEMORY_BASIC_INFORMATION guardPage;
		776	char* guardPagePointer = reinterpret_cast<char*>(stackLimit) + size;
		777	if (VirtualQuery(guardPagePointer, &guardPage, sizeof(guardPage)) > 0) {
		778	ASSERT(guardPage.Protect & PAGE_GUARD);
		779	DWORD oldProtect;
		780	// Remove guard flag from old guard page
		781	BOOL retval = VirtualProtect(guardPagePointer, guardPage.RegionSize, PAGE_READWRITE, &oldProtect);
		782	ASSERT(retval);
		783	char* newGuardPagePointer = reinterpret_cast<char*>(stackLimit) - guardPage.RegionSize;
		784	// Commit new guard page
		785	OSAllocator::commit(newGuardPagePointer, guardPage.RegionSize, true, false);
		786	// Set guard flag on new guard page
		787	retval = VirtualProtect(newGuardPagePointer, guardPage.RegionSize, PAGE_READWRITE \| PAGE_GUARD, &oldProtect);
		788	ASSERT(retval);
		789	}
		790	}
		791	}
		792	#endif
		793
752	inline void VM::updateStackLimit()	794	inline void VM::updateStackLimit()
753	{	795	{
		796	#if PLATFORM(WIN)
		797	void* lastStackLimit = m_stackLimit;
		798	#endif
		799
754	if (m_stackPointerAtVMEntry) {	800	if (m_stackPointerAtVMEntry) {
755	ASSERT(wtfThreadData().stack().isGrowingDownward());	801	ASSERT(wtfThreadData().stack().isGrowingDownward());
756	char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);	802	char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
Lines 769-774 inline void VM::updateStackLimit() Source/JavaScriptCore/runtime/VM.cpp_sec2
769	#endif	815	#endif
770	}	816	}
771		817
		818	#if PLATFORM(WIN)
		819	if (lastStackLimit != m_stackLimit)
		820	preCommitStackMemory(m_stackLimit);
		821	#endif
772	}	822	}
773		823
774	#if ENABLE(FTL_JIT)	824	#if ENABLE(FTL_JIT)

Lines 640-646 Source/WTF/wtf/Platform.h_sec1
- Source/WTF/wtf/Platform.h -4 / +4 lines
640	#if !defined(ENABLE_JIT) \	640	#if !defined(ENABLE_JIT) \
641	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM) \|\| CPU(ARM64) \|\| CPU(MIPS)) \	641	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM) \|\| CPU(ARM64) \|\| CPU(MIPS)) \
642	&& !OS(WINCE) \	642	&& !OS(WINCE) \
643	&& !OS(WINDOWS)	643	&& !(OS(WINDOWS) && CPU(X86_64))
644	#define ENABLE_JIT 1	644	#define ENABLE_JIT 1
645	#endif	645	#endif
646		646
Lines 693-700 Source/WTF/wtf/Platform.h_sec2
693	low-level interpreter. */	693	low-level interpreter. */
694	#if !defined(ENABLE_LLINT) \	694	#if !defined(ENABLE_LLINT) \
695	&& ENABLE(JIT) \	695	&& ENABLE(JIT) \
696	&& (OS(DARWIN) \|\| OS(LINUX) \|\| OS(FREEBSD)) \	696	&& (OS(DARWIN) \|\| OS(LINUX) \|\| OS(FREEBSD) \|\| OS(WINDOWS)) \
697	&& ((OS(DARWIN) && !PLATFORM(EFL)) \|\| PLATFORM(GTK)) \	697	&& ((OS(DARWIN) && !PLATFORM(EFL)) \|\| PLATFORM(GTK) \|\| PLATFORM(WIN)) \
698	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM_THUMB2) \|\| CPU(ARM_TRADITIONAL) \|\| CPU(ARM64) \|\| CPU(MIPS) \|\| CPU(SH4))	698	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM_THUMB2) \|\| CPU(ARM_TRADITIONAL) \|\| CPU(ARM64) \|\| CPU(MIPS) \|\| CPU(SH4))
699	#define ENABLE_LLINT 1	699	#define ENABLE_LLINT 1
700	#endif	700	#endif
Lines 783-789 Source/WTF/wtf/Platform.h_sec3
783	#endif	783	#endif
784		784
785	/* Configure the interpreter */	785	/* Configure the interpreter */
786	#if COMPILER(GCC)	786	#if COMPILER(GCC) \|\| COMPILER(MSVC)
787	#define HAVE_COMPUTED_GOTO 1	787	#define HAVE_COMPUTED_GOTO 1
788	#endif	788	#endif
789		789

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +27 lines
		1	2014-03-04 peavo@outlook.com <peavo@outlook.com>
		2
		3	[Win32][LLINT] Crash when running JSC stress tests.
		4	https://bugs.webkit.org/show_bug.cgi?id=129429
		5
		6	On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
		7	where the guard page is a barrier between committed and uncommitted memory.
		8	When data from the guard page is read or written, the guard page is moved, and memory is committed.
		9	This is how the system grows the stack.
		10	When using the C stack on Windows we need to precommit the needed stack space.
		11	Otherwise we might crash later if we access uncommitted stack memory.
		12	This can happen if we allocate stack space larger than the page guard size (4K).
		13	The system does not get the chance to move the guard page, and commit more memory,
		14	and we crash if uncommitted memory is accessed.
		15	The MSVC compiler fixes this by inserting a call to the _chkstk() function,
		16	when needed, see http://support.microsoft.com/kb/100775.
		17
		18	Reviewed by NOBODY (OOPS!).
		19
		20	* JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
		21	* jit/Repatch.cpp:
		22	(JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
		23	* offlineasm/x86.rb: Compile fix, and small simplification.
		24	* runtime/VM.cpp:
		25	(JSC::preCommitStackMemory): Added function to precommit stack memory.
		26	(JSC::VM::updateStackLimit): Call function to precommit stack memory when stack limit is updated.
		27
1	2014-03-04 Andreas Kling <akling@apple.com>	28	2014-03-04 Andreas Kling <akling@apple.com>
2		29
3	Micro-optimize Strings in JS bindings.	30	Micro-optimize Strings in JS bindings.

Lines 1-3 Source/WTF/ChangeLog_sec1
- Source/WTF/ChangeLog +9 lines
		1	2014-03-04 peavo@outlook.com <peavo@outlook.com>
		2
		3	[Win32][LLINT] Crash when running JSC stress tests.
		4	https://bugs.webkit.org/show_bug.cgi?id=129429
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* wtf/Platform.h: Enable LLINT on Win32.
		9
1	2014-03-02 Jaehun Lim <ljaehun.lim@samsung.com>	10	2014-03-02 Jaehun Lim <ljaehun.lim@samsung.com>
2		11
3	[EFL] Remove m_initEfl from RunLoop.	12	[EFL] Remove m_initEfl from RunLoop.