Attachment 225899 Details for Bug 129429 – Patch

[patch] Patch

bug-129429-20140305210034.patch (text/plain), 8.13 KB, created by peavo on 2014-03-05 12:00:46 PST

(hide)

Description:

Filename:

MIME Type:

Creator: peavo

Created: 2014-03-05 12:00:46 PST

Size: 8.13 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 165106)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,30 @@
>+2014-03-04  peavo@outlook.com  <peavo@outlook.com>
>+
>+        [Win32][LLINT] Crash when running JSC stress tests.
>+        https://bugs.webkit.org/show_bug.cgi?id=129429
>+
>+        On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
>+        where the guard page is a barrier between committed and uncommitted memory.
>+        When data from the guard page is read or written, the guard page is moved, and memory is committed.
>+        This is how the system grows the stack.
>+        When using the C stack on Windows we need to precommit the needed stack space.
>+        Otherwise we might crash later if we access uncommitted stack memory.
>+        This can happen if we allocate stack space larger than the page guard size (4K).
>+        The system does not get the chance to move the guard page, and commit more memory,
>+        and we crash if uncommitted memory is accessed.
>+        The MSVC compiler fixes this by inserting a call to the _chkstk() function,
>+        when needed, see http://support.microsoft.com/kb/100775.
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
>+        * jit/Repatch.cpp:
>+        (JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
>+        * offlineasm/x86.rb: Compile fix, and small simplification.
>+        * runtime/VM.cpp:
>+        (JSC::preCommitStackMemory): Added function to precommit stack memory.
>+        (JSC::VM::updateStackLimit): Call function to precommit stack memory when stack limit is updated.
>+
> 2014-03-04  Filip Pizlo  <fpizlo@apple.com>
> 
>         DFG and FTL should specialize for and support CompareStrictEq over Misc (i.e. boolean, undefined, or null)
>Index: Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh	(revision 165106)
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh	(working copy)
>@@ -29,4 +29,4 @@ printf "END" > LowLevelInterpreterWin.as
> 
> # When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.
> 
>-/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LLIntAssembly.h" || exit 1
>+/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LowLevelInterpreterWin.asm" || exit 1
>Index: Source/JavaScriptCore/jit/Repatch.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/Repatch.cpp	(revision 165106)
>+++ Source/JavaScriptCore/jit/Repatch.cpp	(working copy)
>@@ -824,9 +824,13 @@ static MacroAssembler::Call writeBarrier
>     ASSERT(owner != scratch1);
>     ASSERT(owner != scratch2);
> 
>+#if ENABLE(DFG_JIT)
>     MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
>+#endif
>     MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
>+#if ENABLE(DFG_JIT)
>     definitelyNotMarked.link(&jit);
>+#endif
>     return call;
> }
> #endif // ENABLE(GGC)
>Index: Source/JavaScriptCore/offlineasm/x86.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/x86.rb	(revision 165106)
>+++ Source/JavaScriptCore/offlineasm/x86.rb	(working copy)
>@@ -414,7 +414,7 @@ class BaseIndex
>     end
>     
>     def x86Operand(kind)
>-        if !isIntelSyntax || kind != :double
>+        if !isIntelSyntax
>             x86AddressOperand(:ptr)
>         else
>             "#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"
>@@ -1326,7 +1326,7 @@ class Instruction
>                 }
>             end
>             op = operands[0].x86CallOperand(:ptr)
>-            if isMSVC && (/\Allint_/.match(op) || /\Aslow_path/.match(op))
>+            if isMSVC && (operands[0].is_a? LabelReference)
>                 writeSymbolToFile(op)
>             end
>             $asm.puts "call #{op}"
>Index: Source/JavaScriptCore/runtime/VM.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/VM.cpp	(revision 165106)
>+++ Source/JavaScriptCore/runtime/VM.cpp	(working copy)
>@@ -749,8 +749,37 @@ size_t VM::updateReservedZoneSize(size_t
>     return oldReservedZoneSize;
> }
> 
>+#if PLATFORM(WIN)
>+// On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
>+// where the guard page is a barrier between committed and uncommitted memory.
>+// When data from the guard page is read or written, the guard page is moved, and memory is committed.
>+// This is how the system grows the stack.
>+// When using the C stack on Windows we need to precommit the needed stack space.
>+// Otherwise we might crash later if we access uncommitted stack memory.
>+// This can happen if we allocate stack space larger than the page guard size (4K).
>+// The system does not get the chance to move the guard page, and commit more memory,
>+// and we crash if uncommitted memory is accessed.
>+// The MSVC compiler fixes this by inserting a call to the _chkstk() function,
>+// when needed, see http://support.microsoft.com/kb/100775.
>+// By touching every page up to the stack limit with a dummy operation,
>+// we force the system to move the guard page, and commit memory.
>+
>+static void preCommitStackMemory(void* stackLimit)
>+{
>+    const int pageSize = 4096;
>+    for (volatile char* p = reinterpret_cast<char*>(&stackLimit); p > stackLimit; p -= pageSize) {
>+        char ch = *p;
>+        *p = ch;
>+    }
>+}
>+#endif
>+
> inline void VM::updateStackLimit()
> {
>+#if PLATFORM(WIN)
>+    void* lastStackLimit = m_stackLimit;
>+#endif
>+
>     if (m_stackPointerAtVMEntry) {
>         ASSERT(wtfThreadData().stack().isGrowingDownward());
>         char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
>@@ -769,6 +798,10 @@ inline void VM::updateStackLimit()
> #endif
>     }
> 
>+#if PLATFORM(WIN)
>+    if (lastStackLimit != m_stackLimit)
>+        preCommitStackMemory(m_stackLimit);
>+#endif
> }
> 
> #if ENABLE(FTL_JIT)
>Index: Source/WTF/ChangeLog
>===================================================================
>--- Source/WTF/ChangeLog	(revision 165106)
>+++ Source/WTF/ChangeLog	(working copy)
>@@ -1,3 +1,12 @@
>+2014-03-04  peavo@outlook.com  <peavo@outlook.com>
>+
>+        [Win32][LLINT] Crash when running JSC stress tests.
>+        https://bugs.webkit.org/show_bug.cgi?id=129429
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * wtf/Platform.h: Enable LLINT on Win32.
>+
> 2014-03-04  Zan Dobersek  <zdobersek@igalia.com>
> 
>         [GTK] Build the Udis86 disassembler
>Index: Source/WTF/wtf/Platform.h
>===================================================================
>--- Source/WTF/wtf/Platform.h	(revision 165106)
>+++ Source/WTF/wtf/Platform.h	(working copy)
>@@ -640,7 +640,7 @@
> #if !defined(ENABLE_JIT) \
>     && (CPU(X86) || CPU(X86_64) || CPU(ARM) || CPU(ARM64) || CPU(MIPS)) \
>     && !OS(WINCE) \
>-    && !OS(WINDOWS)
>+    && !(OS(WINDOWS) && CPU(X86_64))
> #define ENABLE_JIT 1
> #endif
> 
>@@ -693,8 +693,8 @@
>    low-level interpreter. */
> #if !defined(ENABLE_LLINT) \
>     && ENABLE(JIT) \
>-    && (OS(DARWIN) || OS(LINUX) || OS(FREEBSD)) \
>-    && ((OS(DARWIN) && !PLATFORM(EFL)) || PLATFORM(GTK)) \
>+    && (OS(DARWIN) || OS(LINUX) || OS(FREEBSD) || OS(WINDOWS)) \
>+    && ((OS(DARWIN) && !PLATFORM(EFL)) || PLATFORM(GTK) || PLATFORM(WIN)) \
>     && (CPU(X86) || CPU(X86_64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(ARM64) || CPU(MIPS) || CPU(SH4))
> #define ENABLE_LLINT 1
> #endif
>@@ -783,7 +783,7 @@
> #endif
> 
> /* Configure the interpreter */
>-#if COMPILER(GCC)
>+#if COMPILER(GCC) || COMPILER(MSVC)
> #define HAVE_COMPUTED_GOTO 1
> #endif
>

Actions: View | Formatted Diff | Diff

Attachments on bug 129429: 225378 | 225383 | 225659 | 225664 | 225791 | 225804 | 225818 | 225899