|
Line 0
a/Source/JavaScriptCore/jit/CallFrameShuffler.cpp_sec1
|
|
|
1 |
/* |
| 2 |
* Copyright (C) 2015 Apple Inc. All rights reserved. |
| 3 |
* |
| 4 |
* Redistribution and use in source and binary forms, with or without |
| 5 |
* modification, are permitted provided that the following conditions |
| 6 |
* are met: |
| 7 |
* 1. Redistributions of source code must retain the above copyright |
| 8 |
* notice, this list of conditions and the following disclaimer. |
| 9 |
* 2. Redistributions in binary form must reproduce the above copyright |
| 10 |
* notice, this list of conditions and the following disclaimer in the |
| 11 |
* documentation and/or other materials provided with the distribution. |
| 12 |
* |
| 13 |
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY |
| 14 |
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 15 |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| 16 |
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR |
| 17 |
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, |
| 18 |
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, |
| 19 |
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
| 20 |
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY |
| 21 |
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 22 |
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 23 |
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 24 |
*/ |
| 25 |
|
| 26 |
#include "config.h" |
| 27 |
#include "CallFrameShuffler.h" |
| 28 |
|
| 29 |
#if ENABLE(JIT) |
| 30 |
|
| 31 |
#include "CCallHelpers.h" |
| 32 |
#include "CodeBlock.h" |
| 33 |
|
| 34 |
namespace JSC { |
| 35 |
|
| 36 |
CallFrameShuffler::CallFrameShuffler(CCallHelpers& jit, const CallFrameShuffleData& data) |
| 37 |
: m_jit(jit) |
| 38 |
, m_oldFrame(data.numLocals + JSStack::CallerFrameAndPCSize, nullptr) |
| 39 |
, m_newFrame(data.args.size() + JSStack::CallFrameHeaderSize, nullptr) |
| 40 |
, m_alignedOldFrameSize(JSStack::CallFrameHeaderSize |
| 41 |
+ roundArgumentCountToAlignFrame(jit.codeBlock()->numParameters())) |
| 42 |
, m_alignedNewFrameSize(JSStack::CallFrameHeaderSize |
| 43 |
+ roundArgumentCountToAlignFrame(data.args.size())) |
| 44 |
, m_lockedRegisters(RegisterSet::allRegisters()) |
| 45 |
{ |
| 46 |
// We are allowed all the usual registers... |
| 47 |
for (unsigned i { GPRInfo::numberOfRegisters }; i--; ) |
| 48 |
m_lockedRegisters.clear(GPRInfo::toRegister(i)); |
| 49 |
for (unsigned i { FPRInfo::numberOfRegisters }; i--; ) |
| 50 |
m_lockedRegisters.clear(FPRInfo::toRegister(i)); |
| 51 |
// ... as well as the runtime registers. |
| 52 |
m_lockedRegisters.exclude(RegisterSet::runtimeRegisters()); |
| 53 |
|
| 54 |
ASSERT(!data.callee.isInJSStack() || data.callee.virtualRegister().isLocal()); |
| 55 |
addNew(VirtualRegister(JSStack::Callee), data.callee); |
| 56 |
|
| 57 |
for (size_t i { 0 }; i < data.args.size(); ++i) { |
| 58 |
ASSERT(!data.args[i].isInJSStack() || data.args[i].virtualRegister().isLocal()); |
| 59 |
addNew(virtualRegisterForArgument(i), data.args[i]); |
| 60 |
} |
| 61 |
|
| 62 |
#if USE(JSVALUE64) |
| 63 |
for (Reg reg { Reg::first() }; reg <= Reg::last(); reg = reg.next()) { |
| 64 |
if (!data.registers[reg].isSet()) |
| 65 |
continue; |
| 66 |
|
| 67 |
RELEASE_ASSERT(reg.isGPR()); |
| 68 |
|
| 69 |
addNew(JSValueRegs(reg.gpr()), |
| 70 |
data.registers[reg]); |
| 71 |
} |
| 72 |
#endif |
| 73 |
} |
| 74 |
|
| 75 |
void CallFrameShuffler::dump(PrintStream& out) const |
| 76 |
{ |
| 77 |
static const char* delimiter = " +-------------------------------+ "; |
| 78 |
static const char* dangerDelimiter = " X-------------------------------X "; |
| 79 |
static const char* dangerBoundsDelimiter = " XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX "; |
| 80 |
static const char* emptySpace = " "; |
| 81 |
ASSERT(m_alignedNewFrameSize <= numLocals()); |
| 82 |
out.print(" "); |
| 83 |
out.print(" Old frame "); |
| 84 |
out.print(" New frame "); |
| 85 |
out.print("\n"); |
| 86 |
for (int i { 0 }; i < m_alignedOldFrameSize + numLocals() + 3; ++i) { |
| 87 |
VirtualRegister old { m_alignedOldFrameSize - i - 1 }; |
| 88 |
VirtualRegister newReg { old + m_frameDelta }; |
| 89 |
|
| 90 |
if (!isValidOld(old) && old != firstOld() - 1 |
| 91 |
&& !isValidNew(newReg) && newReg != firstNew() - 1) |
| 92 |
continue; |
| 93 |
|
| 94 |
out.print(" "); |
| 95 |
if (dangerFrontier() >= firstNew() |
| 96 |
&& (newReg == dangerFrontier() || newReg == firstNew() - 1)) |
| 97 |
out.print(dangerBoundsDelimiter); |
| 98 |
else if (isValidOld(old)) |
| 99 |
out.print(isValidNew(newReg) && isDangerNew(newReg) ? dangerDelimiter : delimiter); |
| 100 |
else if (old == firstOld() - 1) |
| 101 |
out.print(delimiter); |
| 102 |
else |
| 103 |
out.print(emptySpace); |
| 104 |
if (dangerFrontier() >= firstNew() |
| 105 |
&& (newReg == dangerFrontier() || newReg == firstNew() - 1)) |
| 106 |
out.print(dangerBoundsDelimiter); |
| 107 |
else if (isValidNew(newReg) || newReg == firstNew() - 1) |
| 108 |
out.print(isDangerNew(newReg) ? dangerDelimiter : delimiter); |
| 109 |
else |
| 110 |
out.print(emptySpace); |
| 111 |
out.print("\n"); |
| 112 |
if (old == firstOld()) |
| 113 |
out.print(" sp --> "); |
| 114 |
else if (!old.offset()) |
| 115 |
out.print(" fp --> "); |
| 116 |
else |
| 117 |
out.print(" "); |
| 118 |
if (isValidOld(old)) { |
| 119 |
if (getOld(old)) { |
| 120 |
auto str = toCString(old); |
| 121 |
if (isValidNew(newReg) && isDangerNew(newReg)) |
| 122 |
out.printf(" X %18s X ", str.data()); |
| 123 |
else |
| 124 |
out.printf(" | %18s | ", str.data()); |
| 125 |
} else if (isValidNew(newReg) && isDangerNew(newReg)) |
| 126 |
out.printf(" X%30s X ", ""); |
| 127 |
else |
| 128 |
out.printf(" |%30s | ", ""); |
| 129 |
} else |
| 130 |
out.print(emptySpace); |
| 131 |
if (isValidNew(newReg)) { |
| 132 |
const char d = isDangerNew(newReg) ? 'X' : '|'; |
| 133 |
auto str = toCString(newReg); |
| 134 |
if (getNew(newReg)) { |
| 135 |
if (getNew(newReg)->recovery().isConstant()) |
| 136 |
out.printf(" %c%8s <- constant %c ", d, str.data(), d); |
| 137 |
else { |
| 138 |
auto recoveryStr = toCString(getNew(newReg)->recovery()); |
| 139 |
out.printf(" %c%8s <- %18s %c ", d, str.data(), |
| 140 |
recoveryStr.data(), d); |
| 141 |
} |
| 142 |
} else if (newReg == VirtualRegister { JSStack::ArgumentCount }) |
| 143 |
out.printf(" %c%8s <- %18zu %c ", d, str.data(), argCount(), d); |
| 144 |
else |
| 145 |
out.printf(" %c%30s %c ", d, "", d); |
| 146 |
} else |
| 147 |
out.print(emptySpace); |
| 148 |
if (newReg == firstNew() - m_newFrameOffset && !isSlowPath()) |
| 149 |
out.print(" <-- new sp before jump (current ", m_newFrameBase, ") "); |
| 150 |
if (newReg == firstNew()) |
| 151 |
out.print(" <-- new fp after prologue"); |
| 152 |
out.print("\n"); |
| 153 |
} |
| 154 |
out.print(" "); |
| 155 |
out.print(" Live registers "); |
| 156 |
out.print(" Wanted registers "); |
| 157 |
out.print("\n"); |
| 158 |
for (Reg reg { Reg::first() }; reg <= Reg::last(); reg = reg.next()) { |
| 159 |
if (!reg.isGPR()) |
| 160 |
continue; |
| 161 |
|
| 162 |
CachedRecovery* oldCachedRecovery { m_registers[reg.gpr()] }; |
| 163 |
CachedRecovery* newCachedRecovery { m_newRegisters[reg.gpr()] }; |
| 164 |
if (!oldCachedRecovery && !newCachedRecovery) |
| 165 |
continue; |
| 166 |
out.print(" "); |
| 167 |
if (oldCachedRecovery) { |
| 168 |
auto str = toCString(reg.gpr()); |
| 169 |
out.printf(" %8s ", str.data()); |
| 170 |
} else |
| 171 |
out.print(emptySpace); |
| 172 |
#if USE(JSVALUE32_64) |
| 173 |
if (newCachedRecovery) { |
| 174 |
JSValueRegs wantedJSValueRegs { newCachedRecovery->wantedJSValueRegs() }; |
| 175 |
if (reg.gpr() == wantedJSValueRegs.tagGPR()) |
| 176 |
out.print(reg.gpr(), " <- tag(", newCachedRecovery->recovery(), ")"); |
| 177 |
else |
| 178 |
out.print(reg.gpr(), " <- payload(", newCachedRecovery->recovery(), ")"); |
| 179 |
} |
| 180 |
#else |
| 181 |
if (newCachedRecovery) |
| 182 |
out.print(" ", reg.gpr(), " <- ", newCachedRecovery->recovery()); |
| 183 |
#endif |
| 184 |
out.print("\n"); |
| 185 |
} |
| 186 |
out.print(" Locked registers: "); |
| 187 |
bool firstLocked { true }; |
| 188 |
for (Reg reg { Reg::first() }; reg <= Reg::last(); reg = reg.next()) { |
| 189 |
if (!reg.isGPR()) |
| 190 |
continue; |
| 191 |
|
| 192 |
if (m_lockedRegisters.get(reg.gpr())) { |
| 193 |
out.print(firstLocked ? "" : ", ", reg.gpr()); |
| 194 |
firstLocked = false; |
| 195 |
} |
| 196 |
} |
| 197 |
out.print("\n"); |
| 198 |
|
| 199 |
if (isSlowPath()) |
| 200 |
out.print(" Using fp-relative addressing for slow path call\n"); |
| 201 |
else |
| 202 |
out.print(" Using sp-relative addressing for jump (using ", m_newFrameBase, " as new sp)\n"); |
| 203 |
if (m_oldFrameOffset) |
| 204 |
out.print(" Old frame offset is ", m_oldFrameOffset, "\n"); |
| 205 |
if (m_newFrameOffset) |
| 206 |
out.print(" New frame offset is ", m_newFrameOffset, "\n"); |
| 207 |
} |
| 208 |
|
| 209 |
CachedRecovery* CallFrameShuffler::getCachedRecovery(ValueRecovery recovery) |
| 210 |
{ |
| 211 |
ASSERT(!recovery.isConstant()); |
| 212 |
if (recovery.isInGPR()) |
| 213 |
return m_registers[recovery.gpr()]; |
| 214 |
if (recovery.isInFPR()) |
| 215 |
return m_registers[recovery.fpr()]; |
| 216 |
#if USE(JSVALUE32_64) |
| 217 |
if (recovery.technique() == InPair) { |
| 218 |
ASSERT(m_registers[recovery.tagGPR()] == m_registers[recovery.payloadGPR()]); |
| 219 |
return m_registers[recovery.payloadGPR()]; |
| 220 |
} |
| 221 |
#endif |
| 222 |
ASSERT(recovery.isInJSStack()); |
| 223 |
return getOld(recovery.virtualRegister()); |
| 224 |
} |
| 225 |
|
| 226 |
CachedRecovery* CallFrameShuffler::setCachedRecovery(ValueRecovery recovery, CachedRecovery* cachedRecovery) |
| 227 |
{ |
| 228 |
ASSERT(!recovery.isConstant()); |
| 229 |
if (recovery.isInGPR()) |
| 230 |
return m_registers[recovery.gpr()] = cachedRecovery; |
| 231 |
if (recovery.isInFPR()) |
| 232 |
return m_registers[recovery.fpr()] = cachedRecovery; |
| 233 |
#if USE(JSVALUE32_64) |
| 234 |
if (recovery.technique() == InPair) { |
| 235 |
m_registers[recovery.tagGPR()] = cachedRecovery; |
| 236 |
return m_registers[recovery.payloadGPR()] = cachedRecovery; |
| 237 |
} |
| 238 |
#endif |
| 239 |
ASSERT(recovery.isInJSStack()); |
| 240 |
setOld(recovery.virtualRegister(), cachedRecovery); |
| 241 |
return cachedRecovery; |
| 242 |
} |
| 243 |
|
| 244 |
void CallFrameShuffler::spill(CachedRecovery& cachedRecovery) |
| 245 |
{ |
| 246 |
ASSERT(!isSlowPath()); |
| 247 |
ASSERT(cachedRecovery.recovery().isInRegisters()); |
| 248 |
|
| 249 |
VirtualRegister spillSlot { 0 }; |
| 250 |
for (VirtualRegister slot { firstOld() }; slot <= lastOld(); slot -= 1) { |
| 251 |
ASSERT(slot < newAsOld(firstNew())); |
| 252 |
if (getOld(slot)) |
| 253 |
continue; |
| 254 |
|
| 255 |
spillSlot = slot; |
| 256 |
break; |
| 257 |
} |
| 258 |
// We must have enough slots to be able to fit the whole |
| 259 |
// callee's frame for the slow path. |
| 260 |
RELEASE_ASSERT(spillSlot.isLocal()); |
| 261 |
|
| 262 |
if (verbose) |
| 263 |
dataLog(" * Spilling ", cachedRecovery.recovery(), " into ", spillSlot, "\n"); |
| 264 |
auto format = emitStore(cachedRecovery, addressForOld(spillSlot)); |
| 265 |
ASSERT(format != DataFormatNone); |
| 266 |
updateRecovery(cachedRecovery, ValueRecovery::displacedInJSStack(spillSlot, format)); |
| 267 |
} |
| 268 |
|
| 269 |
void CallFrameShuffler::emitDeltaCheck() |
| 270 |
{ |
| 271 |
if (!ASSERT_DISABLED) |
| 272 |
return; |
| 273 |
|
| 274 |
GPRReg scratchGPR { getFreeGPR() }; |
| 275 |
if (scratchGPR != InvalidGPRReg) { |
| 276 |
if (verbose) |
| 277 |
dataLog(" Using ", scratchGPR, " for the fp-sp delta check\n"); |
| 278 |
m_jit.move(GPRInfo::callFrameRegister, scratchGPR); |
| 279 |
m_jit.subPtr(MacroAssembler::stackPointerRegister, scratchGPR); |
| 280 |
MacroAssembler::Jump ok = m_jit.branch32( |
| 281 |
MacroAssembler::Equal, scratchGPR, |
| 282 |
MacroAssembler::TrustedImm32( |
| 283 |
static_cast<size_t>(sizeof(Register) * numLocals()))); |
| 284 |
m_jit.abortWithReason(JITUnexpectedCallFrameSize); |
| 285 |
ok.link(&m_jit); |
| 286 |
} else if (verbose) |
| 287 |
dataLog(" Skipping the fp-sp delta check since there is too much pressure"); |
| 288 |
} |
| 289 |
|
| 290 |
void CallFrameShuffler::prepareForSlowPath() |
| 291 |
{ |
| 292 |
ASSERT(isUndecided()); |
| 293 |
emitDeltaCheck(); |
| 294 |
|
| 295 |
m_frameDelta = numLocals() + JSStack::CallerFrameAndPCSize; |
| 296 |
m_newFrameBase = MacroAssembler::stackPointerRegister; |
| 297 |
m_newFrameOffset = -JSStack::CallerFrameAndPCSize; |
| 298 |
|
| 299 |
if (verbose) |
| 300 |
dataLog("\n\nPreparing frame for slow path call:\n", *this); |
| 301 |
|
| 302 |
prepareAny(); |
| 303 |
|
| 304 |
if (verbose) |
| 305 |
dataLog("Ready for slow path call!\n"); |
| 306 |
} |
| 307 |
|
| 308 |
void CallFrameShuffler::prepareForTailCall() |
| 309 |
{ |
| 310 |
ASSERT(isUndecided()); |
| 311 |
emitDeltaCheck(); |
| 312 |
|
| 313 |
// We'll use sp-based indexing so that we can load the |
| 314 |
// caller's frame pointer into the fpr immediately |
| 315 |
m_oldFrameBase = MacroAssembler::stackPointerRegister; |
| 316 |
m_oldFrameOffset = numLocals(); |
| 317 |
m_newFrameBase = acquireGPR(); |
| 318 |
#if CPU(X86) |
| 319 |
// We load the frame pointer manually, but we need to ask the |
| 320 |
// algorithm to move the return PC for us (it'd probably |
| 321 |
// require a write to the danger zone). Since it'd be awkward |
| 322 |
// to ask for half a value move, we ask that the whole thing |
| 323 |
// be moved for us. |
| 324 |
addNew(VirtualRegister { 0 }, |
| 325 |
ValueRecovery::displacedInJSStack(VirtualRegister(0), DataFormatJS)); |
| 326 |
|
| 327 |
// sp will point to head0 and we will move it up half a slot |
| 328 |
// manually |
| 329 |
m_newFrameOffset = 0; |
| 330 |
#elif CPU(ARM) || CPU(SH4) || CPU(MIPS) |
| 331 |
// We load the the frame pointer and link register |
| 332 |
// manually. We could ask the algorithm to load them for us, |
| 333 |
// and it would allow us to use the link register as an extra |
| 334 |
// temporary - but it'd mean that the frame pointer can also |
| 335 |
// be used as an extra temporary, so we keep the link register |
| 336 |
// locked instead. |
| 337 |
|
| 338 |
// sp will point to head1 since the callee's prologue pushes |
| 339 |
// the call frame and link register. |
| 340 |
m_newFrameOffset = -1; |
| 341 |
#elif CPU(ARM64) |
| 342 |
// We load the frame pointer and link register manually. We |
| 343 |
// could ask the algorithm to load the link register for us |
| 344 |
// (which would allow for its use as an extra temporary), but |
| 345 |
// since its not in GPRInfo, we can't do it. |
| 346 |
|
| 347 |
// sp will point to head2 since the callee's prologue pushes the |
| 348 |
// call frame and link register |
| 349 |
m_newFrameOffset = -2; |
| 350 |
#elif CPU(X86_64) |
| 351 |
// We load the frame pointer manually, but we ask the |
| 352 |
// algorithm to move the return PC for us (it'd probably |
| 353 |
// require a write in the danger zone) |
| 354 |
addNew(VirtualRegister { 1 }, |
| 355 |
ValueRecovery::displacedInJSStack(VirtualRegister(1), DataFormatJS)); |
| 356 |
|
| 357 |
// sp will point to head1 since the callee's prologue pushes |
| 358 |
// the call frame register |
| 359 |
m_newFrameOffset = -1; |
| 360 |
#else |
| 361 |
UNREACHABLE_FOR_PLATFORM(); |
| 362 |
#endif |
| 363 |
|
| 364 |
if (verbose) |
| 365 |
dataLog(" Emitting code for computing the new frame base\n"); |
| 366 |
|
| 367 |
// We compute the new frame base by first computing the top of the |
| 368 |
// old frame (taking into account an argument count higher than |
| 369 |
// the number of parameters), then substracting to it the aligned |
| 370 |
// new frame size (adjusted). |
| 371 |
m_jit.load32(MacroAssembler::Address(GPRInfo::callFrameRegister, JSStack::ArgumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset), m_newFrameBase); |
| 372 |
MacroAssembler::Jump argumentCountOK = |
| 373 |
m_jit.branch32(MacroAssembler::BelowOrEqual, m_newFrameBase, |
| 374 |
MacroAssembler::TrustedImm32(m_jit.codeBlock()->numParameters())); |
| 375 |
m_jit.add32(MacroAssembler::TrustedImm32(stackAlignmentRegisters() - 1 + JSStack::CallFrameHeaderSize), m_newFrameBase); |
| 376 |
m_jit.and32(MacroAssembler::TrustedImm32(-stackAlignmentRegisters()), m_newFrameBase); |
| 377 |
m_jit.mul32(MacroAssembler::TrustedImm32(sizeof(Register)), m_newFrameBase, m_newFrameBase); |
| 378 |
MacroAssembler::Jump done = m_jit.jump(); |
| 379 |
argumentCountOK.link(&m_jit); |
| 380 |
m_jit.move( |
| 381 |
MacroAssembler::TrustedImm32(m_alignedOldFrameSize * sizeof(Register)), |
| 382 |
m_newFrameBase); |
| 383 |
done.link(&m_jit); |
| 384 |
|
| 385 |
m_jit.addPtr(GPRInfo::callFrameRegister, m_newFrameBase); |
| 386 |
m_jit.subPtr( |
| 387 |
MacroAssembler::TrustedImm32( |
| 388 |
(m_alignedNewFrameSize + m_newFrameOffset) * sizeof(Register)), |
| 389 |
m_newFrameBase); |
| 390 |
|
| 391 |
// We want the frame pointer to always point to a valid frame, and |
| 392 |
// we are going to trash the current one. Let's make it point to |
| 393 |
// our caller's frame, since that's what we want to end up with. |
| 394 |
m_jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister), |
| 395 |
MacroAssembler::framePointerRegister); |
| 396 |
|
| 397 |
// We load the link register manually for architectures that have one |
| 398 |
#if CPU(ARM) || CPU(SH4) || CPU(ARM64) |
| 399 |
m_jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, sizeof(void*)), |
| 400 |
MacroAssembler::linkRegister); |
| 401 |
#elif CPU(MIPS) |
| 402 |
m_jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, sizeof(void*)), |
| 403 |
MacroAssembler::returnAddressRegister); |
| 404 |
#endif |
| 405 |
|
| 406 |
if (verbose) |
| 407 |
dataLog("Preparing frame for tail call:\n", *this); |
| 408 |
|
| 409 |
prepareAny(); |
| 410 |
|
| 411 |
#if CPU(X86) |
| 412 |
if (verbose) |
| 413 |
dataLog(" Simulating pop of the call frame register\n"); |
| 414 |
m_jit.addPtr(MacroAssembler::TrustedImm32(sizeof(void*)), MacroAssembler::stackPointerRegister); |
| 415 |
#endif |
| 416 |
|
| 417 |
if (verbose) |
| 418 |
dataLog("Ready for tail call!\n"); |
| 419 |
} |
| 420 |
|
| 421 |
bool CallFrameShuffler::tryWrites(CachedRecovery& cachedRecovery) |
| 422 |
{ |
| 423 |
ASSERT(m_newFrameBase != InvalidGPRReg); |
| 424 |
|
| 425 |
// If the value is already set up correctly, we don't have |
| 426 |
// anything to do. |
| 427 |
if (isSlowPath() && cachedRecovery.recovery().isInJSStack() |
| 428 |
&& cachedRecovery.targets().size() == 1 |
| 429 |
&& (newAsOld(cachedRecovery.targets()[0]) |
| 430 |
== cachedRecovery.recovery().virtualRegister())) { |
| 431 |
cachedRecovery.clearTargets(); |
| 432 |
if (!cachedRecovery.wantedJSValueRegs()) |
| 433 |
clearCachedRecovery(cachedRecovery.recovery()); |
| 434 |
return true; |
| 435 |
} |
| 436 |
|
| 437 |
if (!canLoadAndBox(cachedRecovery)) |
| 438 |
return false; |
| 439 |
|
| 440 |
emitLoad(cachedRecovery); |
| 441 |
emitBox(cachedRecovery); |
| 442 |
ASSERT(cachedRecovery.recovery().isInRegisters() |
| 443 |
|| cachedRecovery.recovery().isConstant()); |
| 444 |
|
| 445 |
if (verbose) |
| 446 |
dataLog(" * Storing ", cachedRecovery.recovery()); |
| 447 |
for (size_t i { 0 }; i < cachedRecovery.targets().size(); ++i) { |
| 448 |
VirtualRegister target { cachedRecovery.targets()[i] }; |
| 449 |
ASSERT(!isDangerNew(target)); |
| 450 |
if (verbose) |
| 451 |
dataLog(!i ? " into " : ", and ", "NEW ", target); |
| 452 |
emitStore(cachedRecovery, addressForNew(target)); |
| 453 |
setNew(target, nullptr); |
| 454 |
} |
| 455 |
if (verbose) |
| 456 |
dataLog("\n"); |
| 457 |
cachedRecovery.clearTargets(); |
| 458 |
if (!cachedRecovery.wantedJSValueRegs()) |
| 459 |
clearCachedRecovery(cachedRecovery.recovery()); |
| 460 |
|
| 461 |
return true; |
| 462 |
} |
| 463 |
|
| 464 |
bool CallFrameShuffler::performSafeWrites() |
| 465 |
{ |
| 466 |
VirtualRegister firstSafe; |
| 467 |
VirtualRegister end { lastNew() + 1 }; |
| 468 |
Vector<VirtualRegister> failures; |
| 469 |
|
| 470 |
// For all cachedRecoveries that writes to the safe zone, if it |
| 471 |
// doesn't also write to the danger zone, we try to perform |
| 472 |
// the writes. This may free up danger slots, so we iterate |
| 473 |
// again until it doesn't happen anymore. |
| 474 |
// |
| 475 |
// Note that even though we have a while block, we look at |
| 476 |
// each slot of the new call frame at most once since in each |
| 477 |
// iteration beyond the first, we only load up the portion of |
| 478 |
// the new call frame that was dangerous and became safe due |
| 479 |
// to the previous iteration. |
| 480 |
do { |
| 481 |
firstSafe = dangerFrontier() + 1; |
| 482 |
if (verbose) |
| 483 |
dataLog(" Trying safe writes (between NEW ", firstSafe, " and NEW ", end - 1, ")\n"); |
| 484 |
bool didProgress = false; |
| 485 |
for (VirtualRegister reg { firstSafe }; reg < end; reg += 1) { |
| 486 |
CachedRecovery* cachedRecovery = getNew(reg); |
| 487 |
if (!cachedRecovery) { |
| 488 |
if (verbose) |
| 489 |
dataLog(" + ", reg, " is OK.\n"); |
| 490 |
continue; |
| 491 |
} |
| 492 |
if (!hasOnlySafeWrites(*cachedRecovery)) { |
| 493 |
if (verbose) { |
| 494 |
dataLog(" - ", cachedRecovery->recovery(), " writes to NEW ", reg, |
| 495 |
" but also has dangerous writes.\n"); |
| 496 |
} |
| 497 |
continue; |
| 498 |
} |
| 499 |
if (cachedRecovery->wantedJSValueRegs()) { |
| 500 |
if (verbose) { |
| 501 |
dataLog(" - ", cachedRecovery->recovery(), " writes to NEW ", reg, |
| 502 |
" but is also needed in registers.\n"); |
| 503 |
} |
| 504 |
continue; |
| 505 |
} |
| 506 |
if (!tryWrites(*cachedRecovery)) { |
| 507 |
if (verbose) |
| 508 |
dataLog(" - Unable to write to NEW ", reg, " from ", cachedRecovery->recovery(), "\n"); |
| 509 |
failures.append(reg); |
| 510 |
} |
| 511 |
didProgress = true; |
| 512 |
} |
| 513 |
end = firstSafe; |
| 514 |
|
| 515 |
// If we have cachedRecoveries that failed to write, it is |
| 516 |
// because they are on the stack and we didn't have enough |
| 517 |
// registers available at the time to load them into. If |
| 518 |
// we have a free register, we should try again because it |
| 519 |
// could free up some danger slots. |
| 520 |
if (didProgress && hasFreeRegister()) { |
| 521 |
Vector<VirtualRegister> stillFailing; |
| 522 |
for (VirtualRegister failed : failures) { |
| 523 |
CachedRecovery* cachedRecovery = getNew(failed); |
| 524 |
// It could have been handled later if it had |
| 525 |
// several targets |
| 526 |
if (!cachedRecovery) |
| 527 |
continue; |
| 528 |
|
| 529 |
ASSERT(hasOnlySafeWrites(*cachedRecovery) |
| 530 |
&& !cachedRecovery->wantedJSValueRegs()); |
| 531 |
if (!tryWrites(*cachedRecovery)) |
| 532 |
stillFailing.append(failed); |
| 533 |
} |
| 534 |
failures = WTF::move(stillFailing); |
| 535 |
} |
| 536 |
if (verbose && firstSafe != dangerFrontier() + 1) |
| 537 |
dataLog(" We freed up danger slots!\n"); |
| 538 |
} while (firstSafe != dangerFrontier() + 1); |
| 539 |
|
| 540 |
return failures.isEmpty(); |
| 541 |
} |
| 542 |
|
| 543 |
void CallFrameShuffler::prepareAny() |
| 544 |
{ |
| 545 |
ASSERT(!isUndecided()); |
| 546 |
|
| 547 |
updateDangerFrontier(); |
| 548 |
|
| 549 |
// First, we try to store any value that goes above the danger |
| 550 |
// frontier. This will never use more registers since we are only |
| 551 |
// loading+storing if we ensure that any register used for the load |
| 552 |
// will be freed up after the stores (i.e., all stores are above |
| 553 |
// the danger frontier, and there is no wanted register). |
| 554 |
performSafeWrites(); |
| 555 |
|
| 556 |
// At this point, we couldn't have more available registers than |
| 557 |
// we have withouth spilling: all values currently in registers |
| 558 |
// either require a write to the danger zone, or have a wanted |
| 559 |
// register, which means that in any case they will have to go |
| 560 |
// through registers again. |
| 561 |
|
| 562 |
// We now slowly free up the danger zone by first loading the old |
| 563 |
// value on the danger frontier, spilling as many registers as |
| 564 |
// needed to do so and ensuring that the corresponding slot in the |
| 565 |
// new frame is now ready to be written. Then, we store the old |
| 566 |
// value to its target location if possible (we could have failed |
| 567 |
// to load it previously due to high pressure). Finally, we write |
| 568 |
// to any of the newly safe slots that we can, which could free up |
| 569 |
// registers (hence why we do it eagerly). |
| 570 |
for (VirtualRegister reg { dangerFrontier() }; reg >= firstNew(); reg -= 1) { |
| 571 |
if (reg == dangerFrontier()) { |
| 572 |
if (verbose) |
| 573 |
dataLog(" Next slot (NEW ", reg, ") is the danger frontier\n"); |
| 574 |
CachedRecovery* cachedRecovery { getOld(newAsOld(dangerFrontier())) }; |
| 575 |
ASSERT(cachedRecovery); |
| 576 |
ensureLoad(*cachedRecovery); |
| 577 |
emitLoad(*cachedRecovery); |
| 578 |
ensureBox(*cachedRecovery); |
| 579 |
emitBox(*cachedRecovery); |
| 580 |
if (hasOnlySafeWrites(*cachedRecovery)) |
| 581 |
tryWrites(*cachedRecovery); |
| 582 |
} else if (verbose) |
| 583 |
dataLog(" Next slot is NEW ", reg, "\n"); |
| 584 |
|
| 585 |
ASSERT(!isDangerNew(reg)); |
| 586 |
CachedRecovery* cachedRecovery = getNew(reg); |
| 587 |
// This could be one of the header slots we don't care about. |
| 588 |
if (!cachedRecovery) { |
| 589 |
if (verbose) |
| 590 |
dataLog(" + ", reg, " is OK\n"); |
| 591 |
continue; |
| 592 |
} |
| 593 |
|
| 594 |
if (canLoadAndBox(*cachedRecovery) && hasOnlySafeWrites(*cachedRecovery) |
| 595 |
&& !cachedRecovery->wantedJSValueRegs()) { |
| 596 |
emitLoad(*cachedRecovery); |
| 597 |
emitBox(*cachedRecovery); |
| 598 |
bool writesOK = tryWrites(*cachedRecovery); |
| 599 |
ASSERT(writesOK); |
| 600 |
} else if (verbose) |
| 601 |
dataLog(" - ", cachedRecovery->recovery(), " can't be handled just yet.\n"); |
| 602 |
} |
| 603 |
ASSERT(dangerFrontier() < firstNew()); |
| 604 |
|
| 605 |
// Now, the danger zone is empty, but we still have a couple of |
| 606 |
// things to do: |
| 607 |
// |
| 608 |
// 1) There could be remaining safe writes that failed earlier due |
| 609 |
// to high register pressure and had nothing to do with the |
| 610 |
// danger zone whatsoever. |
| 611 |
// |
| 612 |
// 2) Some wanted registers could have to be loaded (this could |
| 613 |
// happen either when making a call to a new function with a |
| 614 |
// lower number of arguments - since above here, we only load |
| 615 |
// wanted registers when they are at the danger frontier -, or |
| 616 |
// if a wanted register got spilled). |
| 617 |
// |
| 618 |
// 3) Some wanted registers could have been loaded in the wrong |
| 619 |
// registers |
| 620 |
// |
| 621 |
// 4) We have to take care of some bookkeeping - namely, storing |
| 622 |
// the argument count and updating the stack pointer. |
| 623 |
|
| 624 |
// At this point, we must have enough registers available for |
| 625 |
// handling 1). None of the loads can fail because we have been |
| 626 |
// eagerly freeing up registers in all the previous phases - so |
| 627 |
// the only values that are in registers at this point must have |
| 628 |
// wanted registers. |
| 629 |
if (verbose) |
| 630 |
dataLog(" Danger zone is clear, performing remaining writes.\n"); |
| 631 |
for (VirtualRegister reg { firstNew() }; reg <= lastNew(); reg += 1) { |
| 632 |
CachedRecovery* cachedRecovery { getNew(reg) }; |
| 633 |
if (!cachedRecovery) |
| 634 |
continue; |
| 635 |
|
| 636 |
emitLoad(*cachedRecovery); |
| 637 |
emitBox(*cachedRecovery); |
| 638 |
bool writesOK = tryWrites(*cachedRecovery); |
| 639 |
ASSERT(writesOK); |
| 640 |
} |
| 641 |
|
| 642 |
// Handle 2) by loading all registers. We don't have to do any |
| 643 |
// writes, since they have been taken care of above. |
| 644 |
if (verbose) |
| 645 |
dataLog(" Loading wanted GPRs into registers\n"); |
| 646 |
for (Reg reg { Reg::first() }; reg <= Reg::last(); reg = reg.next()) { |
| 647 |
CachedRecovery* cachedRecovery { m_newRegisters[reg] }; |
| 648 |
if (!cachedRecovery) |
| 649 |
continue; |
| 650 |
ASSERT(reg.isGPR()); |
| 651 |
|
| 652 |
emitLoad(*cachedRecovery); |
| 653 |
emitBox(*cachedRecovery); |
| 654 |
ASSERT(cachedRecovery->targets().isEmpty()); |
| 655 |
} |
| 656 |
|
| 657 |
// At this point, we have read everything we cared about from the |
| 658 |
// stack, and written everything we had to to the stack. |
| 659 |
if (verbose) |
| 660 |
dataLog(" Callee frame is fully set up\n"); |
| 661 |
if (!ASSERT_DISABLED) { |
| 662 |
for (VirtualRegister reg { firstNew() }; reg <= lastNew(); reg += 1) |
| 663 |
ASSERT_UNUSED(reg, !getNew(reg)); |
| 664 |
|
| 665 |
for (CachedRecovery* cachedRecovery : m_cachedRecoveries) { |
| 666 |
ASSERT_UNUSED(cachedRecovery, cachedRecovery->targets().isEmpty()); |
| 667 |
ASSERT(!cachedRecovery->recovery().isInJSStack()); |
| 668 |
} |
| 669 |
} |
| 670 |
|
| 671 |
// We need to handle 4) first because it implies releasing |
| 672 |
// m_newFrameBase, which could be a wanted register. |
| 673 |
if (verbose) |
| 674 |
dataLog(" * Storing the argument count into ", VirtualRegister { JSStack::ArgumentCount }, "\n"); |
| 675 |
m_jit.store32(MacroAssembler::TrustedImm32(0), |
| 676 |
addressForNew(VirtualRegister { JSStack::ArgumentCount }).withOffset(TagOffset)); |
| 677 |
m_jit.store32(MacroAssembler::TrustedImm32(argCount()), |
| 678 |
addressForNew(VirtualRegister { JSStack::ArgumentCount }).withOffset(PayloadOffset)); |
| 679 |
|
| 680 |
if (!isSlowPath()) { |
| 681 |
ASSERT(m_newFrameBase != MacroAssembler::stackPointerRegister); |
| 682 |
if (verbose) |
| 683 |
dataLog(" Releasing the new frame base pointer\n"); |
| 684 |
m_jit.move(m_newFrameBase, MacroAssembler::stackPointerRegister); |
| 685 |
releaseGPR(m_newFrameBase); |
| 686 |
} |
| 687 |
|
| 688 |
// Finally we handle 3) |
| 689 |
if (verbose) |
| 690 |
dataLog(" Ensuring wanted registers are in the right register\n"); |
| 691 |
for (Reg reg { Reg::first() }; reg <= Reg::last(); reg = reg.next()) { |
| 692 |
CachedRecovery* cachedRecovery { m_newRegisters[reg] }; |
| 693 |
if (!cachedRecovery) |
| 694 |
continue; |
| 695 |
ASSERT(reg.isGPR()); |
| 696 |
|
| 697 |
emitDisplace(*cachedRecovery); |
| 698 |
} |
| 699 |
} |
| 700 |
|
| 701 |
} // namespace JSC |
| 702 |
|
| 703 |
#endif // ENABLE(JIT) |