WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
[patch]
the patch
blah.patch (text/plain), 23.77 KB, created by
Filip Pizlo
on 2017-08-07 15:24:52 PDT
(
hide
)
Description:
the patch
Filename:
MIME Type:
Creator:
Filip Pizlo
Created:
2017-08-07 15:24:52 PDT
Size:
23.77 KB
patch
obsolete
>Index: Source/JavaScriptCore/ChangeLog >=================================================================== >--- Source/JavaScriptCore/ChangeLog (revision 220352) >+++ Source/JavaScriptCore/ChangeLog (working copy) >@@ -1,3 +1,35 @@ >+2017-08-07 Filip Pizlo <fpizlo@apple.com> >+ >+ Baseline JIT should do caging >+ https://bugs.webkit.org/show_bug.cgi?id=175037 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ Adds a AssemblyHelpers::cage and cageConditionally. Uses it in the baseline JIT. >+ >+ Also modifies FTL caging to be more defensive when caging is disabled. >+ >+ * ftl/FTLLowerDFGToB3.cpp: >+ (JSC::FTL::DFG::LowerDFGToB3::caged): >+ * jit/AssemblyHelpers.h: >+ (JSC::AssemblyHelpers::cage): >+ (JSC::AssemblyHelpers::cageConditionally): >+ * jit/JITPropertyAccess.cpp: >+ (JSC::JIT::emitDoubleLoad): >+ (JSC::JIT::emitContiguousLoad): >+ (JSC::JIT::emitArrayStorageLoad): >+ (JSC::JIT::emitGenericContiguousPutByVal): >+ (JSC::JIT::emitArrayStoragePutByVal): >+ (JSC::JIT::emit_op_get_from_scope): >+ (JSC::JIT::emit_op_put_to_scope): >+ (JSC::JIT::emitIntTypedArrayGetByVal): >+ (JSC::JIT::emitFloatTypedArrayGetByVal): >+ (JSC::JIT::emitIntTypedArrayPutByVal): >+ (JSC::JIT::emitFloatTypedArrayPutByVal): >+ * jsc.cpp: >+ (jscmain): >+ (primitiveGigacageDisabled): Deleted. >+ > 2017-08-06 Filip Pizlo <fpizlo@apple.com> > > Primitive auxiliaries and JSValue auxiliaries should have separate gigacages >Index: Source/JavaScriptCore/jsc.cpp >=================================================================== >--- Source/JavaScriptCore/jsc.cpp (revision 220352) >+++ Source/JavaScriptCore/jsc.cpp (working copy) >@@ -3802,12 +3802,6 @@ int runJSC(CommandLine options, bool isW > return result; > } > >-static void primitiveGigacageDisabled(void*) >-{ >- dataLog("Primitive gigacage disabled! Aborting.\n"); >- UNREACHABLE_FOR_PLATFORM(); >-} >- > int jscmain(int argc, char** argv) > { > // Need to override and enable restricted options before we start parsing options below. >@@ -3826,8 +3820,7 @@ int jscmain(int argc, char** argv) > #if ENABLE(WEBASSEMBLY) > JSC::Wasm::enableFastMemory(); > #endif >- if (Gigacage::shouldBeEnabled()) >- Gigacage::addPrimitiveDisableCallback(primitiveGigacageDisabled, nullptr); >+ Gigacage::disableDisablingPrimitiveGigacageIfShouldBeEnabled(); > > int result; > result = runJSC( >Index: Source/JavaScriptCore/bytecode/AccessCase.cpp >=================================================================== >--- Source/JavaScriptCore/bytecode/AccessCase.cpp (revision 220352) >+++ Source/JavaScriptCore/bytecode/AccessCase.cpp (working copy) >@@ -527,6 +527,8 @@ void AccessCase::generateImpl(AccessGene > jit.loadPtr( > CCallHelpers::Address(baseForAccessGPR, JSObject::butterflyOffset()), > loadedValueGPR); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > storageGPR = loadedValueGPR; > } > >@@ -877,6 +879,8 @@ void AccessCase::generateImpl(AccessGene > // already had out-of-line property storage). > > jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR3); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > > // We have scratchGPR = new storage, scratchGPR3 = old storage, > // scratchGPR2 = available >@@ -955,8 +959,11 @@ void AccessCase::generateImpl(AccessGene > JSObject::offsetOfInlineStorage() + > offsetInInlineStorage(m_offset) * sizeof(JSValue))); > } else { >- if (!allocating) >+ if (!allocating) { > jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 >+ } > jit.storeValue( > valueRegs, > CCallHelpers::Address(scratchGPR, offsetInButterfly(m_offset) * sizeof(JSValue))); >@@ -992,6 +999,8 @@ void AccessCase::generateImpl(AccessGene > > case ArrayLength: { > jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > jit.load32(CCallHelpers::Address(scratchGPR, ArrayStorage::lengthOffset()), scratchGPR); > state.failAndIgnore.append( > jit.branch32(CCallHelpers::LessThan, scratchGPR, CCallHelpers::TrustedImm32(0))); >Index: Source/JavaScriptCore/bytecode/InlineAccess.cpp >=================================================================== >--- Source/JavaScriptCore/bytecode/InlineAccess.cpp (revision 220351) >+++ Source/JavaScriptCore/bytecode/InlineAccess.cpp (working copy) >@@ -57,6 +57,8 @@ void InlineAccess::dumpCacheSizesAndCras > jit.patchableBranch32( > CCallHelpers::NotEqual, value, CCallHelpers::TrustedImm32(IsArray | ContiguousShape)); > jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > jit.load32(CCallHelpers::Address(value, ArrayStorage::lengthOffset()), value); > jit.boxInt32(scratchGPR, regs); > >@@ -73,6 +75,8 @@ void InlineAccess::dumpCacheSizesAndCras > jit.loadPtr( > CCallHelpers::Address(base, JSObject::butterflyOffset()), > value); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > GPRReg storageGPR = value; > jit.loadValue( > CCallHelpers::Address(storageGPR, 0x000ab21ca), regs); >@@ -116,6 +120,8 @@ void InlineAccess::dumpCacheSizesAndCras > MacroAssembler::TrustedImm32(0x000ab21ca)); > > jit.loadPtr(MacroAssembler::Address(base, JSObject::butterflyOffset()), value); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > jit.storeValue( > regs, > MacroAssembler::Address(base, 120342)); >@@ -170,6 +176,8 @@ bool InlineAccess::generateSelfPropertyA > storage = base; > else { > jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value.payloadGPR()); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > storage = value.payloadGPR(); > } > >@@ -231,6 +239,8 @@ bool InlineAccess::generateSelfPropertyR > storage = getScratchRegister(stubInfo); > ASSERT(storage != InvalidGPRReg); > jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), storage); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > } > > jit.storeValue( >@@ -269,6 +279,8 @@ bool InlineAccess::generateArrayLength(S > auto branchToSlowPath = jit.patchableBranch32( > CCallHelpers::NotEqual, scratch, CCallHelpers::TrustedImm32(array->indexingType())); > jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value.payloadGPR()); >+ // FIXME: Do caging! >+ // https://bugs.webkit.org/show_bug.cgi?id=175295 > jit.load32(CCallHelpers::Address(value.payloadGPR(), ArrayStorage::lengthOffset()), value.payloadGPR()); > jit.boxInt32(value.payloadGPR(), value); > >Index: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp >=================================================================== >--- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (revision 220352) >+++ Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (working copy) >@@ -11616,7 +11616,10 @@ private: > > LValue caged(Gigacage::Kind kind, LValue ptr) > { >- if (kind == Gigacage::Primitive) { >+ if (!Gigacage::shouldBeEnabled()) >+ return ptr; >+ >+ if (kind == Gigacage::Primitive && Gigacage::canPrimitiveGigacageBeDisabled()) { > if (vm().primitiveGigacageEnabled().isStillValid()) > m_graph.watchpoints().addLazily(vm().primitiveGigacageEnabled()); > else >Index: Source/JavaScriptCore/jit/AssemblyHelpers.h >=================================================================== >--- Source/JavaScriptCore/jit/AssemblyHelpers.h (revision 220351) >+++ Source/JavaScriptCore/jit/AssemblyHelpers.h (working copy) >@@ -1311,6 +1311,34 @@ public: > ok.link(this); > } > >+ void cage(Gigacage::Kind kind, GPRReg storage) >+ { >+ if (!Gigacage::shouldBeEnabled()) >+ return; >+ >+#if GIGACAGE_ENABLED >+ andPtr(TrustedImmPtr(static_cast<size_t>(GIGACAGE_MASK)), storage); >+ addPtr(AbsoluteAddress(Gigacage::basePtr(kind)), storage); >+#endif >+ } >+ >+ void cageConditionally(Gigacage::Kind kind, GPRReg storage, GPRReg scratch) >+ { >+ if (!Gigacage::shouldBeEnabled()) >+ return; >+ >+ if (kind != Gigacage::Primitive || Gigacage::isDisablingPrimitiveGigacageDisabled()) >+ return cage(kind, storage); >+ >+ loadPtr(Gigacage::basePtr(kind), scratch); >+ Jump done = branchTestPtr(Zero, scratch); >+#if GIGACAGE_ENABLED >+ andPtr(TrustedImmPtr(static_cast<size_t>(GIGACAGE_MASK)), storage); >+ addPtr(scratch, storage); >+#endif >+ done.link(this); >+ } >+ > void storeButterfly(VM& vm, GPRReg butterfly, GPRReg object) > { > if (isX86()) { >Index: Source/JavaScriptCore/jit/JITPropertyAccess.cpp >=================================================================== >--- Source/JavaScriptCore/jit/JITPropertyAccess.cpp (revision 220351) >+++ Source/JavaScriptCore/jit/JITPropertyAccess.cpp (working copy) >@@ -172,9 +172,8 @@ JIT::JumpList JIT::emitDoubleLoad(Instru > JumpList slowCases; > > badType = patchableBranch32(NotEqual, regT2, TrustedImm32(DoubleShape)); >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2); >+ cage(Gigacage::JSValue, regT2); > slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength()))); > loadDouble(BaseIndex(regT2, regT1, TimesEight), fpRegT0); > slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0)); >@@ -187,9 +186,8 @@ JIT::JumpList JIT::emitContiguousLoad(In > JumpList slowCases; > > badType = patchableBranch32(NotEqual, regT2, TrustedImm32(expectedShape)); >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2); >+ cage(Gigacage::JSValue, regT2); > slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength()))); > load64(BaseIndex(regT2, regT1, TimesEight), regT0); > slowCases.append(branchTest64(Zero, regT0)); >@@ -204,9 +202,8 @@ JIT::JumpList JIT::emitArrayStorageLoad( > add32(TrustedImm32(-ArrayStorageShape), regT2, regT3); > badType = patchableBranch32(Above, regT3, TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)); > >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2); >+ cage(Gigacage::JSValue, regT2); > slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset()))); > > load64(BaseIndex(regT2, regT1, TimesEight, ArrayStorage::vectorOffset()), regT0); >@@ -353,9 +350,8 @@ JIT::JumpList JIT::emitGenericContiguous > > badType = patchableBranch32(NotEqual, regT2, TrustedImm32(indexingShape)); > >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2); >+ cage(Gigacage::JSValue, regT2); > Jump outOfBounds = branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())); > > Label storeResult = label(); >@@ -410,9 +406,8 @@ JIT::JumpList JIT::emitArrayStoragePutBy > JumpList slowCases; > > badType = patchableBranch32(NotEqual, regT2, TrustedImm32(ArrayStorageShape)); >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2); >+ cage(Gigacage::JSValue, regT2); > slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset()))); > > Jump empty = branchTest64(Zero, BaseIndex(regT2, regT1, TimesEight, ArrayStorage::vectorOffset())); >@@ -923,9 +918,8 @@ void JIT::emit_op_get_from_scope(Instruc > abortWithReason(JITOffsetIsNotOutOfLine); > isOutOfLine.link(this); > } >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(base, JSObject::butterflyOffset()), scratch); >+ cage(Gigacage::JSValue, scratch); > neg32(offset); > signExtend32ToPtr(offset, offset); > load64(BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)), result); >@@ -1066,9 +1060,8 @@ void JIT::emit_op_put_to_scope(Instructi > emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection. > emitGetVirtualRegister(value, regT2); > >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0); >+ cage(Gigacage::JSValue, regT0); > loadPtr(operandSlot, regT1); > negPtr(regT1); > storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue))); >@@ -1576,12 +1569,14 @@ JIT::JumpList JIT::emitIntTypedArrayGetB > RegisterID property = regT1; > RegisterID resultPayload = regT0; > RegisterID scratch = regT3; >+ RegisterID scratch2 = regT4; > #else > RegisterID base = regT0; > RegisterID property = regT2; > RegisterID resultPayload = regT0; > RegisterID resultTag = regT1; > RegisterID scratch = regT3; >+ RegisterID scratch2 = regT4; > #endif > > JumpList slowCases; >@@ -1589,9 +1584,8 @@ JIT::JumpList JIT::emitIntTypedArrayGetB > load8(Address(base, JSCell::typeInfoTypeOffset()), scratch); > badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type))); > slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength()))); >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch); >+ cageConditionally(Gigacage::Primitive, scratch, scratch2); > > switch (elementSize(type)) { > case 1: >@@ -1649,12 +1643,14 @@ JIT::JumpList JIT::emitFloatTypedArrayGe > RegisterID property = regT1; > RegisterID resultPayload = regT0; > RegisterID scratch = regT3; >+ RegisterID scratch2 = regT4; > #else > RegisterID base = regT0; > RegisterID property = regT2; > RegisterID resultPayload = regT0; > RegisterID resultTag = regT1; > RegisterID scratch = regT3; >+ RegisterID scratch2 = regT4; > #endif > > JumpList slowCases; >@@ -1662,9 +1658,8 @@ JIT::JumpList JIT::emitFloatTypedArrayGe > load8(Address(base, JSCell::typeInfoTypeOffset()), scratch); > badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type))); > slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength()))); >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch); >+ cageConditionally(Gigacage::Primitive, scratch, scratch2); > > switch (elementSize(type)) { > case 4: >@@ -1705,11 +1700,13 @@ JIT::JumpList JIT::emitIntTypedArrayPutB > RegisterID property = regT1; > RegisterID earlyScratch = regT3; > RegisterID lateScratch = regT2; >+ RegisterID lateScratch2 = regT4; > #else > RegisterID base = regT0; > RegisterID property = regT2; > RegisterID earlyScratch = regT3; > RegisterID lateScratch = regT1; >+ RegisterID lateScratch2 = regT4; > #endif > > JumpList slowCases; >@@ -1731,9 +1728,8 @@ JIT::JumpList JIT::emitIntTypedArrayPutB > > // We would be loading this into base as in get_by_val, except that the slow > // path expects the base to be unclobbered. >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch); >+ cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2); > > if (isClamped(type)) { > ASSERT(elementSize(type) == 1); >@@ -1777,11 +1773,13 @@ JIT::JumpList JIT::emitFloatTypedArrayPu > RegisterID property = regT1; > RegisterID earlyScratch = regT3; > RegisterID lateScratch = regT2; >+ RegisterID lateScratch2 = regT4; > #else > RegisterID base = regT0; > RegisterID property = regT2; > RegisterID earlyScratch = regT3; > RegisterID lateScratch = regT1; >+ RegisterID lateScratch2 = regT4; > #endif > > JumpList slowCases; >@@ -1816,9 +1814,8 @@ JIT::JumpList JIT::emitFloatTypedArrayPu > > // We would be loading this into base as in get_by_val, except that the slow > // path expects the base to be unclobbered. >- // FIXME: Should do caging. >- // https://bugs.webkit.org/show_bug.cgi?id=175037 > loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch); >+ cageConditionally(Gigacage::Primitive, lateScratch, lateScratch2); > > switch (elementSize(type)) { > case 4: >Index: Source/WTF/ChangeLog >=================================================================== >--- Source/WTF/ChangeLog (revision 220352) >+++ Source/WTF/ChangeLog (working copy) >@@ -1,3 +1,16 @@ >+2017-08-07 Filip Pizlo <fpizlo@apple.com> >+ >+ Baseline JIT should do caging >+ https://bugs.webkit.org/show_bug.cgi?id=175037 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * wtf/Gigacage.h: >+ (Gigacage::disableDisablingPrimitiveGigacageIfShouldBeEnabled): >+ (Gigacage::isDisablingPrimitiveGigacageDisabled): >+ (Gigacage::isPrimitiveGigacagePermanentlyEnabled): >+ (Gigacage::canPrimitiveGigacageBeDisabled): >+ > 2017-08-06 Filip Pizlo <fpizlo@apple.com> > > Primitive auxiliaries and JSValue auxiliaries should have separate gigacages >Index: Source/WTF/wtf/Gigacage.h >=================================================================== >--- Source/WTF/wtf/Gigacage.h (revision 220352) >+++ Source/WTF/wtf/Gigacage.h (working copy) >@@ -49,6 +49,12 @@ inline bool shouldBeEnabled() { return f > inline void addPrimitiveDisableCallback(void (*)(void*), void*) { } > inline void removePrimitiveDisableCallback(void (*)(void*), void*) { } > >+inline void disableDisablingPrimitiveGigacageIfShouldBeEnabled() { } >+ >+inline bool isDisablingPrimitiveGigacageDisabled() { return false; } >+inline bool isPrimitiveGigacagePermanentlyEnabled() { return false; } >+inline bool canPrimitiveGigacageBeDisabled() { return true; } >+ > ALWAYS_INLINE const char* name(Kind kind) > { > switch (kind) { >Index: Source/WebKit/ChangeLog >=================================================================== >--- Source/WebKit/ChangeLog (revision 220352) >+++ Source/WebKit/ChangeLog (working copy) >@@ -1,3 +1,16 @@ >+2017-08-07 Filip Pizlo <fpizlo@apple.com> >+ >+ Baseline JIT should do caging >+ https://bugs.webkit.org/show_bug.cgi?id=175037 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ Use a better API to disable disabling the primitive gigacage. >+ >+ * WebProcess/WebProcess.cpp: >+ (WebKit::m_webSQLiteDatabaseTracker): >+ (WebKit::primitiveGigacageDisabled): Deleted. >+ > 2017-08-06 Filip Pizlo <fpizlo@apple.com> > > Primitive auxiliaries and JSValue auxiliaries should have separate gigacages >Index: Source/WebKit/WebProcess/WebProcess.cpp >=================================================================== >--- Source/WebKit/WebProcess/WebProcess.cpp (revision 220352) >+++ Source/WebKit/WebProcess/WebProcess.cpp (working copy) >@@ -146,11 +146,6 @@ static const Seconds nonVisibleProcessCl > > namespace WebKit { > >-static void primitiveGigacageDisabled(void*) >-{ >- UNREACHABLE_FOR_PLATFORM(); >-} >- > WebProcess& WebProcess::singleton() > { > static WebProcess& process = *new WebProcess; >@@ -202,8 +197,7 @@ WebProcess::WebProcess() > parentProcessConnection()->send(Messages::WebResourceLoadStatisticsStore::ResourceLoadStatisticsUpdated(WTFMove(statistics)), 0); > }); > >- if (Gigacage::shouldBeEnabled()) >- Gigacage::addPrimitiveDisableCallback(primitiveGigacageDisabled, nullptr); >+ Gigacage::disableDisablingPrimitiveGigacageIfShouldBeEnabled(); > } > > WebProcess::~WebProcess() >Index: Source/bmalloc/ChangeLog >=================================================================== >--- Source/bmalloc/ChangeLog (revision 220355) >+++ Source/bmalloc/ChangeLog (working copy) >@@ -1,3 +1,24 @@ >+2017-08-07 Filip Pizlo <fpizlo@apple.com> >+ >+ Baseline JIT should do caging >+ https://bugs.webkit.org/show_bug.cgi?id=175037 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ This centralizes the notion of permanently enabling the primitive gigacage, which we only do in jsc >+ and WebProcess. >+ >+ This saves the baseline JIT from emitting some code. Otherwise it would always have to emit enabled >+ checks on each typed array access. >+ >+ * bmalloc/Gigacage.cpp: >+ (Gigacage::primitiveGigacageDisabled): >+ (Gigacage::disableDisablingPrimitiveGigacageIfShouldBeEnabled): >+ (Gigacage::isDisablingPrimitiveGigacageDisabled): >+ * bmalloc/Gigacage.h: >+ (Gigacage::isPrimitiveGigacagePermanentlyEnabled): >+ (Gigacage::canPrimitiveGigacageBeDisabled): >+ > 2017-08-06 Filip Pizlo <fpizlo@apple.com> > > Primitive auxiliaries and JSValue auxiliaries should have separate gigacages >Index: Source/bmalloc/bmalloc/Gigacage.cpp >=================================================================== >--- Source/bmalloc/bmalloc/Gigacage.cpp (revision 220352) >+++ Source/bmalloc/bmalloc/Gigacage.cpp (working copy) >@@ -41,6 +41,8 @@ using namespace bmalloc; > > namespace Gigacage { > >+static bool s_isDisablingPrimitiveGigacageDisabled; >+ > struct Callback { > Callback() { } > >@@ -131,6 +133,28 @@ void removePrimitiveDisableCallback(void > } > } > >+static bool False; >+ >+static void primitiveGigacageDisabled(void*) >+{ >+ fprintf(stderr, "FATAL: Primitive gigacage disabled, but we don't want that in this process\n"); >+ if (!False) >+ BCRASH(); >+} >+ >+void disableDisablingPrimitiveGigacageIfShouldBeEnabled() >+{ >+ if (shouldBeEnabled()) { >+ addPrimitiveDisableCallback(primitiveGigacageDisabled, nullptr); >+ s_isDisablingPrimitiveGigacageDisabled = true; >+ } >+} >+ >+bool isDisablingPrimitiveGigacageDisabled() >+{ >+ return s_isDisablingPrimitiveGigacageDisabled; >+} >+ > bool shouldBeEnabled() > { > return GIGACAGE_ENABLED && !PerProcess<Environment>::get()->isDebugHeapEnabled(); >Index: Source/bmalloc/bmalloc/Gigacage.h >=================================================================== >--- Source/bmalloc/bmalloc/Gigacage.h (revision 220352) >+++ Source/bmalloc/bmalloc/Gigacage.h (working copy) >@@ -63,6 +63,12 @@ BEXPORT void disablePrimitiveGigacage(); > BEXPORT void addPrimitiveDisableCallback(void (*)(void*), void*); > BEXPORT void removePrimitiveDisableCallback(void (*)(void*), void*); > >+BEXPORT void disableDisablingPrimitiveGigacageIfShouldBeEnabled(); >+ >+BEXPORT bool isDisablingPrimitiveGigacageDisabled(); >+inline bool isPrimitiveGigacagePermanentlyEnabled() { return isDisablingPrimitiveGigacageDisabled(); } >+inline bool canPrimitiveGigacageBeDisabled() { return !isDisablingPrimitiveGigacageDisabled(); } >+ > BINLINE const char* name(Kind kind) > { > switch (kind) {
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=317479">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 175037
:
317476
|
317479
|
317486