Attachment 225378 Details for Bug 129429 – Patch

[patch] Patch

bug-129429-20140227182213.patch (text/plain), 12.15 KB, created by peavo on 2014-02-27 09:22:29 PST

(hide)

Description:

Filename:

MIME Type:

Creator: peavo

Created: 2014-02-27 09:22:29 PST

Size: 12.15 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 164806)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,29 @@
>+2014-02-27  peavo@outlook.com  <peavo@outlook.com>
>+
>+        [Win32][LLINT] Crash when running JSC stress tests.
>+        https://bugs.webkit.org/show_bug.cgi?id=129429
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
>+        If so, we need to read or write some data on every following guard page
>+        to make sure the system commits the previously uncommitted stack memory.
>+        Otherwise we might crash later if we access uncommitted stack memory.
>+
>+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
>+        * jit/AssemblyHelpers.cpp:
>+        (JSC::AssemblyHelpers::moveStackGuardPage): Added method to move stack guard page.
>+        * jit/AssemblyHelpers.h:
>+        (JSC::AssemblyHelpers::moveStackPointer): Added method to move stack pointer.
>+        * jit/JIT.cpp:
>+        (JSC::JIT::privateCompile): Use moveStackPointer method, which will move the guard page.
>+        * jit/JITCall32_64.cpp:
>+        (JSC::JIT::compileLoadVarargs): Ditto.
>+        * jit/Repatch.cpp:
>+        (JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
>+        * llint/LowLevelInterpreter.asm: Added macro to move stack guard page.
>+        * offlineasm/x86.rb: Compile fix.
>+
> 2014-02-27  Gabor Rapcsanyi  <rgabor@webkit.org>
> 
>         r164764 broke the ARM build
>Index: Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh	(revision 164781)
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh	(working copy)
>@@ -29,4 +29,4 @@ printf "END" > LowLevelInterpreterWin.as
> 
> # When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.
> 
>-/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LLIntAssembly.h" || exit 1
>+/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LowLevelInterpreterWin.asm" || exit 1
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(revision 164781)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(working copy)
>@@ -70,6 +70,34 @@ void AssemblyHelpers::clearSamplingFlag(
> }
> #endif
> 
>+#if PLATFORM(WIN)
>+// On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
>+// If so, we need to read or write some data on every following guard page
>+// to make sure the system commits the previously uncommitted stack memory.
>+// Otherwise we might crash later if we access uncommitted stack memory.
>+// See http ://msdn.microsoft.com/en-us/library/ms686774%28VS.85%29.aspx
>+
>+void AssemblyHelpers::moveStackGuardPage(int offset, RegisterID base, RegisterID temp)
>+{
>+    const int winStackGuardPageSize = 4096;
>+    const TrustedImm32 delta(winStackGuardPageSize - 16);
>+
>+    move(TrustedImm32(-offset), temp);
>+    sub32(base, temp);
>+    add32(stackPointerRegister, temp);
>+
>+    Label moveGuardPageLoop(this);
>+    Jump jmp = branch32(LessThan, temp, delta);
>+    sub32(delta, temp);
>+    sub32(delta, stackPointerRegister);
>+    // Dummy operation to make sure the system commits memory, and moves the guard page.
>+    sub32(TrustedImm32(0), Address(stackPointerRegister));
>+    jump(moveGuardPageLoop);
>+    Label doneMovingGuardPage(this);
>+    jmp.linkTo(doneMovingGuardPage, this);
>+}
>+#endif
>+
> #if !ASSERT_DISABLED
> #if USE(JSVALUE64)
> void AssemblyHelpers::jitAssertIsInt32(GPRReg gpr)
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.h
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.h	(revision 164781)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.h	(working copy)
>@@ -67,6 +67,20 @@ public:
> #endif
>     }
> 
>+#if PLATFORM(WIN)
>+    void moveStackGuardPage(int offset, RegisterID base, RegisterID temp);
>+#endif
>+
>+    ALWAYS_INLINE void moveStackPointer(int offset, RegisterID base, RegisterID temp)
>+    {
>+        temp;
>+#if PLATFORM(WIN)
>+        moveStackGuardPage(offset, base, temp);
>+#endif
>+        addPtr(TrustedImm32(offset), base, stackPointerRegister);
>+    }
>+
>+
> #if CPU(X86_64) || CPU(X86)
>     size_t prologueStackPointerDelta()
>     {
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 164781)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -522,7 +522,7 @@ CompilationResult JIT::privateCompile(JI
>         stackOverflow = branchPtr(Above, AbsoluteAddress(m_vm->addressOfStackLimit()), regT1);
>     }
> 
>-    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
>+    moveStackPointer(stackPointerOffsetFor(m_codeBlock) * sizeof(Register), callFrameRegister, regT2);
>     checkStackPointerAlignment();
> 
>     privateCompileMainPass();
>Index: Source/JavaScriptCore/jit/JITCall32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITCall32_64.cpp	(revision 164781)
>+++ Source/JavaScriptCore/jit/JITCall32_64.cpp	(working copy)
>@@ -188,7 +188,7 @@ void JIT::compileLoadVarargs(Instruction
> 
>     emitLoad(arguments, regT1, regT0);
>     callOperation(operationSizeFrameForVarargs, regT1, regT0, firstFreeRegister, firstVarArgOffset);
>-    addPtr(TrustedImm32(-sizeof(CallerFrameAndPC)), returnValueGPR, stackPointerRegister);
>+    moveStackPointer(-sizeof(CallerFrameAndPC), returnValueGPR, regT4);
>     emitLoad(thisValue, regT1, regT4);
>     emitLoad(arguments, regT3, regT2);
>     callOperation(operationLoadVarargs, returnValueGPR, regT1, regT4, regT3, regT2, firstVarArgOffset);
>Index: Source/JavaScriptCore/jit/Repatch.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/Repatch.cpp	(revision 164781)
>+++ Source/JavaScriptCore/jit/Repatch.cpp	(working copy)
>@@ -824,9 +824,13 @@ static MacroAssembler::Call writeBarrier
>     ASSERT(owner != scratch1);
>     ASSERT(owner != scratch2);
> 
>+#if ENABLE(DFG_JIT)
>     MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
>+#endif
>     MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
>+#if ENABLE(DFG_JIT)
>     definitelyNotMarked.link(&jit);
>+#endif
>     return call;
> }
> #endif // ENABLE(GGC)
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 164781)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -383,6 +383,29 @@ macro callToJavaScriptEpilogue()
>     end
> end
> 
>+# On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
>+# If so, we need to read or write some data on every following guard page
>+# to make sure the system commits the previously uncommitted stack memory.
>+# Otherwise we might crash later if we access uncommitted stack memory.
>+# See http://msdn.microsoft.com/en-us/library/ms686774%28VS.85%29.aspx
>+
>+macro moveStackPointerAndGuardPage(reg, scratch)
>+    const winStackGuardPageSize = 4096
>+    const delta = winStackGuardPageSize - 16
>+
>+    subi reg, scratch
>+    addi sp, scratch
>+.updateSpLoop:
>+    bilt scratch, delta, .almostDoneUpdateSp
>+    subi delta, scratch
>+    subi delta, sp
>+    # Dummy operation to make sure the system commits memory, and moves the guard page.
>+    subi 0, [sp]
>+    jmp .updateSpLoop
>+.almostDoneUpdateSp:
>+    subi scratch, sp
>+end
>+
> macro moveStackPointerForCodeBlock(codeBlock, scratch)
>     loadi CodeBlock::m_numCalleeRegisters[codeBlock], scratch
>     lshiftp 3, scratch
>@@ -390,6 +413,8 @@ macro moveStackPointerForCodeBlock(codeB
>     if ARMv7
>         subp cfr, scratch, scratch
>         move scratch, sp
>+    elsif X86_WIN
>+        moveStackPointerAndGuardPage(cfr, scratch)
>     else
>         subp cfr, scratch, sp
>     end
>@@ -991,6 +1016,9 @@ _llint_op_call_varargs:
>         if ARMv7
>             subp t1, CallerFrameAndPCSize, t2
>             move t2, sp
>+        elsif X86_WIN
>+            move CallerFrameAndPCSize, t2
>+            moveStackPointerAndGuardPage(t1, t2)
>         else
>             subp t1, CallerFrameAndPCSize, sp
>         end
>Index: Source/JavaScriptCore/offlineasm/x86.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/x86.rb	(revision 164781)
>+++ Source/JavaScriptCore/offlineasm/x86.rb	(working copy)
>@@ -414,7 +414,7 @@ class BaseIndex
>     end
>     
>     def x86Operand(kind)
>-        if !isIntelSyntax || kind != :double
>+        if !isIntelSyntax
>             x86AddressOperand(:ptr)
>         else
>             "#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"
>Index: Source/WTF/ChangeLog
>===================================================================
>--- Source/WTF/ChangeLog	(revision 164806)
>+++ Source/WTF/ChangeLog	(working copy)
>@@ -1,3 +1,12 @@
>+2014-02-27  peavo@outlook.com  <peavo@outlook.com>
>+
>+        [Win32][LLINT] Crash when running JSC stress tests.
>+        https://bugs.webkit.org/show_bug.cgi?id=129429
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * wtf/Platform.h: Enable LLINT on Win32.
>+
> 2014-02-26  Gavin Barraclough  <barraclough@apple.com>
> 
>         FastMalloc should use vm_page_shift intead of PAGE_SHIFT.
>Index: Source/WTF/wtf/Platform.h
>===================================================================
>--- Source/WTF/wtf/Platform.h	(revision 164781)
>+++ Source/WTF/wtf/Platform.h	(working copy)
>@@ -640,7 +640,7 @@
> #if !defined(ENABLE_JIT) \
>     && (CPU(X86) || CPU(X86_64) || CPU(ARM) || CPU(ARM64) || CPU(MIPS)) \
>     && !OS(WINCE) \
>-    && !OS(WINDOWS)
>+    && !(OS(WINDOWS) && CPU(X86_64))
> #define ENABLE_JIT 1
> #endif
> 
>@@ -693,8 +693,8 @@
>    low-level interpreter. */
> #if !defined(ENABLE_LLINT) \
>     && ENABLE(JIT) \
>-    && (OS(DARWIN) || OS(LINUX) || OS(FREEBSD)) \
>-    && ((OS(DARWIN) && !PLATFORM(EFL)) || PLATFORM(GTK)) \
>+    && (OS(DARWIN) || OS(LINUX) || OS(FREEBSD) || OS(WINDOWS)) \
>+    && ((OS(DARWIN) && !PLATFORM(EFL)) || PLATFORM(GTK) || PLATFORM(WIN)) \
>     && (CPU(X86) || CPU(X86_64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(ARM64) || CPU(MIPS) || CPU(SH4))
> #define ENABLE_LLINT 1
> #endif
>@@ -783,7 +783,7 @@
> #endif
> 
> /* Configure the interpreter */
>-#if COMPILER(GCC)
>+#if COMPILER(GCC) || COMPILER(MSVC)
> #define HAVE_COMPUTED_GOTO 1
> #endif
> 
>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 164806)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,12 @@
>+2014-02-27  peavo@outlook.com  <peavo@outlook.com>
>+
>+        [Win32][LLINT] Crash when running JSC stress tests.
>+        https://bugs.webkit.org/show_bug.cgi?id=129429
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * platform/graphics/texmap/TextureMapperGL.cpp: Include a WinCairo compile fix.
>+
> 2014-02-27  Commit Queue  <commit-queue@webkit.org>
> 
>         Unreviewed, rolling out r164783.
>Index: Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
>===================================================================
>--- Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp	(revision 164781)
>+++ Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp	(working copy)
>@@ -1128,10 +1128,12 @@ PassRefPtr<BitmapTexture> TextureMapperG
>     return adoptRef(texture);
> }
> 
>+#if USE(TEXTURE_MAPPER_GL)
> PassOwnPtr<TextureMapper> TextureMapper::platformCreateAccelerated()
> {
>     return TextureMapperGL::create();
> }
>+#endif
> 
> };
> #endif

Actions: View | Formatted Diff | Diff

Attachments on bug 129429: 225378 | 225383 | 225659 | 225664 | 225791 | 225804 | 225818 | 225899