Attachment 380460 Details for Bug 193885 – Patch

[patch] Patch

patchRemoveSpectreOptions (text/plain), 5.33 KB, created by Robin Morisset on 2019-10-08 13:45:24 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Robin Morisset

Created: 2019-10-08 13:45:24 PDT

Size: 5.33 KB

patch

obsolete

>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index a651f8bd8b8..8b836c47810 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,21 @@
>+2019-10-08  Robin Morisset  <rmorisset@apple.com>
>+
>+        Remove Options::enableSpectreMitigations
>+        https://bugs.webkit.org/show_bug.cgi?id=193885
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Remove enableSpectreGadgets and enableSpectreMitigations
>+
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
>+        * jit/JIT.cpp:
>+        (JSC::JIT::JIT):
>+        * jit/JIT.h:
>+        * runtime/OptionsList.h:
>+        * wasm/WasmB3IRGenerator.cpp:
>+        (JSC::Wasm::B3IRGenerator::addCallIndirect):
>+
> 2019-10-07  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         [JSC] Clean up ThunkGenerator's nativeCallTrampoline generator code
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index e41bfc27ed0..d0c19ebf6a3 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -157,7 +157,6 @@ public:
>         , m_availabilityCalculator(m_graph)
>         , m_state(state.graph)
>         , m_interpreter(state.graph, m_state)
>-        , m_indexMaskingMode(Options::enableSpectreMitigations() ?  IndexMaskingEnabled : IndexMaskingDisabled)
>     {
>         if (Options::validateAbstractInterpreterState()) {
>             performLivenessAnalysis(m_graph);
>@@ -17801,10 +17800,6 @@ private:
>     DFG::BasicBlock* m_nextHighBlock;
>     LBasicBlock m_nextLowBlock;
> 
>-    enum IndexMaskingMode { IndexMaskingDisabled, IndexMaskingEnabled };
>-
>-    IndexMaskingMode m_indexMaskingMode;
>-
>     NodeOrigin m_origin;
>     unsigned m_nodeIndex;
>     Node* m_node;
>diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
>index efad55c1e42..6f98e42894c 100644
>--- a/Source/JavaScriptCore/jit/JIT.cpp
>+++ b/Source/JavaScriptCore/jit/JIT.cpp
>@@ -82,7 +82,6 @@ JIT::JIT(VM& vm, CodeBlock* codeBlock, unsigned loopOSREntryBytecodeOffset)
>     , m_pcToCodeOriginMapBuilder(vm)
>     , m_canBeOptimized(false)
>     , m_shouldEmitProfiling(false)
>-    , m_shouldUseIndexMasking(Options::enableSpectreMitigations())
>     , m_loopOSREntryBytecodeOffset(loopOSREntryBytecodeOffset)
> {
> }
>diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
>index 427e9aedf59..73797d79fdf 100644
>--- a/Source/JavaScriptCore/jit/JIT.h
>+++ b/Source/JavaScriptCore/jit/JIT.h
>@@ -967,7 +967,6 @@ namespace JSC {
>         bool m_canBeOptimized;
>         bool m_canBeOptimizedOrInlined;
>         bool m_shouldEmitProfiling;
>-        bool m_shouldUseIndexMasking;
>         unsigned m_loopOSREntryBytecodeOffset { 0 };
>     };
> 
>diff --git a/Source/JavaScriptCore/runtime/OptionsList.h b/Source/JavaScriptCore/runtime/OptionsList.h
>index 461f0388f0a..b0a6c7aa2d2 100644
>--- a/Source/JavaScriptCore/runtime/OptionsList.h
>+++ b/Source/JavaScriptCore/runtime/OptionsList.h
>@@ -416,8 +416,6 @@ namespace JSC {
>     \
>     v(Bool, useWebAssembly, true, Normal, "Expose the WebAssembly global object.") \
>     \
>-    v(Bool, enableSpectreMitigations, true, Restricted, "Enable Spectre mitigations.") \
>-    v(Bool, enableSpectreGadgets, false, Restricted, "enable gadgets to test Spectre mitigations.") \
>     v(Bool, zeroStackFrame, false, Normal, "Zero stack frame on entry to a function.") \
>     \
>     v(Bool, failToCompileWebAssemblyCode, false, Normal, "If true, no Wasm::Plan will sucessfully compile a function.") \
>diff --git a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>index 8ef70780996..8c6e6e2bc80 100644
>--- a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>@@ -1676,7 +1676,6 @@ auto B3IRGenerator::addCallIndirect(unsigned tableIndex, const Signature& signat
>     ExpressionType callableFunctionBuffer;
>     ExpressionType instancesBuffer;
>     ExpressionType callableFunctionBufferLength;
>-    ExpressionType mask;
>     {
>         ExpressionType table = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), origin(),
>             instanceValue(), safeCast<int32_t>(Instance::offsetOfTablePtr(m_numImportFunctions, tableIndex)));
>@@ -1686,9 +1685,6 @@ auto B3IRGenerator::addCallIndirect(unsigned tableIndex, const Signature& signat
>             table, safeCast<int32_t>(FuncRefTable::offsetOfInstances()));
>         callableFunctionBufferLength = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Int32, origin(),
>             table, safeCast<int32_t>(Table::offsetOfLength()));
>-        mask = m_currentBlock->appendNew<Value>(m_proc, ZExt32, origin(),
>-            m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Int32, origin(),
>-                table, safeCast<int32_t>(Table::offsetOfMask())));
>     }
> 
>     // Check the index we are looking for is valid.
>@@ -1703,9 +1699,6 @@ auto B3IRGenerator::addCallIndirect(unsigned tableIndex, const Signature& signat
> 
>     calleeIndex = m_currentBlock->appendNew<Value>(m_proc, ZExt32, origin(), calleeIndex);
> 
>-    if (Options::enableSpectreMitigations())
>-        calleeIndex = m_currentBlock->appendNew<Value>(m_proc, BitAnd, origin(), mask, calleeIndex);
>-
>     ExpressionType callableFunction;
>     {
>         // Compute the offset in the table index space we are looking for.

Actions: View | Formatted Diff | Diff

Attachments on bug 193885: 380460 | 388639 | 388939